正如MySkullCaveIsADarkPlace在注解中所解释的，您的问题是JSON值"null"

"config":"null"

Isnot null。它是包含字符null的非空字符串值。空值如下所示：

"config":null // Notice there are no quotes around the text

有关确认信息，请参见original JSON proposal。
如果您无法修复JSON以正确表示空值，则需要编写custom JsonConverter来检查"null"文本值并返回null（如果存在）。如果不存在，则转换器应继续默认的反序列化。
问题 How to use default serialization in a custom System.Text.Json JsonConverter? 有this answer，this answer提供了一个DefaultConverterFactory<T>，抓取它并将其子类化如下：
空对象的空文本值转换器

public sealed class NullTextValueForNullObjectConverter<T> :
 DefaultConverterFactory<T> where T : class
{
   const string NullValue = "null";
        
   protected override T Read(ref Utf8JsonReader reader, Type typeToConvert, 
                 JsonSerializerOptions modifiedOptions) 
   {
      if (reader.TokenType == JsonTokenType.String)
      {
        var s = reader.GetString();
        // Or use StringComparison.Ordinal if you are sure the 
        // text "null" will always be lowercase
        if (string.Equals(s, NullValue, StringComparison.OrdinalIgnoreCase)) 
                    return null;
      }
      return (T)JsonSerializer.Deserialize(ref reader, typeToConvert, modifiedOptions);
    }
}

默认转换器工厂

public abstract class DefaultConverterFactory<T> : JsonConverterFactory
{
    class DefaultConverter : JsonConverter<T>
    {
       readonly JsonSerializerOptions modifiedOptions;
       readonly DefaultConverterFactory<T> factory;

       public DefaultConverter(JsonSerializerOptions options, DefaultConverterFactory<T> factory)
       {
           this.factory = factory;
           this.modifiedOptions = options.CopyAndRemoveConverter(factory.GetType());
       }

       public override void Write(Utf8JsonWriter writer, T value, JsonSerializerOptions options) => factory.Write(writer, value, modifiedOptions);

       public override T Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options) 
            => factory.Read(ref reader, typeToConvert, modifiedOptions);
    }

    protected virtual T Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions modifiedOptions)
            => (T)JsonSerializer.Deserialize(ref reader, typeToConvert, modifiedOptions);

    protected virtual void Write(Utf8JsonWriter writer, T value, JsonSerializerOptions modifiedOptions) 
            => JsonSerializer.Serialize(writer, value, modifiedOptions);

    public override bool CanConvert(Type typeToConvert) 
            => typeof(T) == typeToConvert;

    public override JsonConverter CreateConverter(Type typeToConvert, JsonSerializerOptions options) 
            => new DefaultConverter(options, this);
}

JSON序列化程序扩展

public static class JsonSerializerExtensions
{
    public static JsonSerializerOptions CopyAndRemoveConverter(this JsonSerializerOptions options, Type converterType)
    {
        var copy = new JsonSerializerOptions(options);
        for (var i = copy.Converters.Count - 1; i >= 0; i--)
            if (copy.Converters[i].GetType() == converterType)
                copy.Converters.RemoveAt(i);
        return copy;
    }
}

然后将转换器添加到JsonSerializerOptions.Converters，如下所示：

var options = new JsonSerializerOptions
{
    Converters = { new NullTextValueForNullObjectConverter<Config>() },
    // Other options as required
    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
    PropertyNameCaseInsensitive = true
};
var webResponseWithConfig = JsonSerializer.Deserialize<WebResponse>(jsonWithConfig, options);

或者直接应用于Config属性，如下所示：

[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]   
[JsonConverter(typeof(NullTextValueForNullObjectConverter<Config>))]
public Config Config { get; set; }

请注意，目前似乎没有一种方法可以生成一个默认的序列化，即直接将转换器应用于Config类型，因此，我不推荐这样做。
演示小提琴here。

如果您无法修复JSON源代码，那么在这种特殊情况下，我建议使用c#字符串替换函数将"null"替换为null

json = json.Replace("\"null\"","null");