OpenSSH 9.0 released

AFAICT this applies only to wildcard "*" and ~ expansion. The wildcard expansion was using the shell on the server end so originally you would have to escape it to prevent the client shell from expanding it. I interpret this to mean it now works similar to how rsync and wildcard expansion works (IOW the sftpd daemon does the expansion instead of the shell so double-quoting is not necessary). As for which method is "correct" I think is subjective but the argument is that service-side expansion is more secure than shell expansion.

As far as tilde "~" expansion I think they are saying that it's not part of the protocol and worked "by accident" do to the server-side shell expansion but if the server is running 8.7+ and has the appropriate extension enabled then it will still work.