This does not answer my question.

In fact, in the meantime, I found the solution myself (in case anybody else is interested): For Scrypt coins (not for SHA-256 or X11), the difficulty values used in miner softwares and pools (but not the coin difficulty itself!) are scaled by a factor of 65536 (2^16). Divide the difficulties by that factor if you want to compare them to the block difficulty. Then suddenly everything falls in place again.

Or, said in another way: A share with difficulty 1 is actually difficulty 2^(-16). So you need 65536 more shares than you think in order to find a block (on average, of course).

I posted the full explanation here: https://bitcoin.stackexchange.com/a/61166/62320