So as it turns out while the string:
AT+CWSAP="\x53\x50\x53\x3a\x20\x41\x55\x53\x00\x00\x00\x63\x3b\x15\x0a\x07\x3b\x76\xff\x31\x07\x5b\xcd\x15\x7a\x02\x00\x00\x00\x00\x00\x00","",1,0

doesn't work, this one does:

AT+CWSAP="\x53\x50\x53\x3a\x20\x41\x55\x53\x00\x00\x00\x63\x3b\x15\x0a\x07\x3b\x76\xff\x31\x07\x5b\xcd\x15\x7a\x02\x00\x00\x00\x00\x00","",1,0

What's different about them?

Well one is 32 octets and the other is 31. The one that works is 31 octets. I think I found a bug in these modules (unless it's fixed in a later version). Edit: confirmed elsewhere (looks like I might re-arrange the SSID format to account for other devices possibly not implementing the standard correctly; I might just shift the application ID by 8bits making it 24bit).

Edit:

I just restarted and tried to replicate it and it doesn't work again. I'll reattack tomorrow.