does this mean you're always mining at difficulty 1, so you have a block ready the moment the difficulty drops after 20 minutes without a block?
Yes. Because if you have a field in the block header called "difficulty", then you have to put something there. And you have a choice: putting the real difficulty, or the minimal one. If you have an ASIC, you can put the real one. But: if you mine for example a half-baked block with your ASIC, then you cannot submit "the best header you did", because it does not meet the network difficulty. After 20 minutes, even if you have ASIC, you have to switch to the minimal difficulty, and mine it separately.
So, the conclusion is: all is left to the network propagation. Both CPU and ASIC miners have their blocks with minimal difficulty, prepared in advance. And then, the winner is not the one, who can mine it faster. The winner is the one, who can propagate it faster. And for that reason, you can compete with ASICs, and mine some blocks even on your CPU.
But obviously, this method is not bulletproof. First, if you have some ASIC, then you can decide to reorg all CPU-mined blocks, and nobody will stop you. Second, you have to mine and propagate a block. Serious miners are well-connected, so if your propagation is worse, then you will get a block, but it will be stale.
Edit: One more thing: obviously, if someone is mining with CPU-only difficulty, then the time of the block is set to 20 minutes. But the real difficulty is set to 10 minutes. So, it is normal to have ASICs in-between.
Another observation is that mining on top of some ASIC block is the easiest thing to do, because ASICs usually set the real time in their blocks, while CPU miners are working on the future, for example one or two hours forward (so after some ASIC block, there is a wider room for propagating new CPU blocks).
