Checking out the mitigation for CVE-2019-6111 [1], how does `sftp` help?

     * scp(1): Relating to the above changes to scp(1); the scp protocol
       relies on the remote shell for wildcard expansion, so there is no
       infallible way for the client's wildcard matching to perfectly
       reflect the server's. If there is a difference between client and
       server wildcard expansion, the client may refuse files from the
       server. For this reason, we have provided a new "-T" flag to scp
       that disables these client-side checks at the risk of
       reintroducing the attack described above.

You could just do a remote `ls` and then `sftp` all the files listed to your client - nothing stopping a malicious return from `ls`? Surely it's the risk of running any kind of wild card copy? If the server is compromised then there's no telling what will be returned from such a command?

    The scp protocol is outdated, inflexible and not readily fixed. We
    recommend the use of more modern protocols like sftp and rsync for
    file transfer instead.

The protocol itself might be outdated, but surely one of the best aspects of `scp` comes from its simplicity [2]?

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111

[2] https://github.com/openssh/openssh-portable/blob/master/scp....