[exim] Readsocket used in a manualrouter

I can't sort out why this doesn't work, but would love if anyone can tell
me if I'm barking up the wrong tree, I've searched exhaustively and I can't
see an issue.

Using the readsocket support in exim
https://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html

The idea was to check a server for where it should route to dynamically
(using manualrouter)
Here is the readsocket command

${readsocket{inet:example.com:4900
}{getroute\040$primary_hostname}{2s}{}{*\040127.0.0.1}}

Testing string expansion works

exim -be
> ${readsocket{inet:example.com:4900
}{getroute\040$primary_hostname}{2s}{}{*\040127.0.0.1}}
* 1.2.3.4 <-- is the right setting, just redacted for this purpose
>
My configuration

send_to_gateway:
        driver = manualroute
        domains = !+local_domains
        transport = remote_smtp
        route_list = ${readsocket{inet:example.com:4900
}{getroute\040$primary_hostname}{2s}{}{*\040127.0.0.1}}

Test Fails, the transport send_to_gateway is skipped:

exim -bt fo@???
non-TFO mode connection attempt to example.com, 30 data
fo@???
  router = lookuphost, transport = remote_smtp
  host aspmx.l.google.com      [108.177.10.27]  MX=10
  host alt1.aspmx.l.google.com [74.125.138.26]  MX=20
  host alt2.aspmx.l.google.com [64.233.186.27]  MX=30
  host alt3.aspmx.l.google.com [173.194.218.27] MX=40
  host alt4.aspmx.l.google.com [64.233.186.26]  MX=50

When I change route_list to be a ip of a server I get (correctly)

send_to_gateway:
        driver = manualroute
        domains = !+local_domains
        transport = remote_smtp
        route_list = * 1.2.3.5

exim -bt fo@???
fo@???
router = send_to_gateway, transport = remote_smtp
host 1.2.3.5 [1.2.3.5]

Readsocket docs appear to let you send and receive data,however, it appears
route_list is not set properly. I assume this should work, any debugging
hints would be greatly appreciated.

I've currently got log_selector = +all in my config and it doesn't help, it
appears to fail silently.

There is a bit in the manual about forbid_filter_readsocket and I've
removed any trace of that from the config as well, still a no go.

Thanks!