No, that is definitely the problem--it can't connect remotely. I just don't know why. I've been using other servers for which SAM is successfully retrieving perfmon counters (for example, the "Windows Server 2003-2012 Services and Counters" template) to determine what "right" looks like.
But your comment got me refocused on the real problem: "access", so I started looking at the firewall again. I searched a bit on remote perfmon issues, and one recommendation was to enable the pre-defined "Performance Logs and Alerts (TCP-In)" rule. This rule is not enabled on most of my servers--and they seem to work, but I enabled it just to test--and it worked! I was able to remotely connect PerfMon from the SAM server to the web server, and every unknown counter on my web server came up in SAM except "URI Cache Flushes Counter". I was ecstatic for about 2 minutes. I was sitting in SAM, hitting "Poll Now", waiting patiently for that last counter to go green, when they ALL stopped working again!!! The rule is still enabled, nothing else changed! I can still connect and monitor those same counters from the SAM server, but SAM is back to "Unknown" on all of them. So fricking confusing!