The docs state:

# Set USERNAME and PASSWORD of a user that has at least SELECT permission
# to ALL databases.

However this is not completely accurate. The simplest fix is to just give your backup user global lock_tables:

  update user set Lock_tables_priv='Y' where Host='foo' and User='backup_user'

You will need to do this on each host from whom backups are taken.