The grants are setup by the ISPConfig installer during the initial installation of the slave, the grants are set for specific columns, that's why you don't see them by looking into the table grants, by looking into the other tables in the mysql.mysql database, you will see them. The ISPConfig version on the master server is the same than the one of the Debian 9 server, right? because that's a prerequisite for a multiserver system, the ISPConfig version must be the same on all nodes. If you would try to add a slave with a newer ISPconfig version to a master that runs an older ISPConfig version, then this must fail.
they're all 3.1.x im going through an update process now (I had horrendous problems last time though) Master first?
It matters that they all use the exact same version, so being 3.1.x is not enough. Yes, master first.