Fwiw, I found a bunch of clients and libraries that didn't support AES-GCM at all, or only very recently. libssh2 is one example. That's made me nervous to make AES-GCM the only supported cipher as a mitigation.
FYI: libssh2 supports AES-GCM since 1.11.0 (released 2023-05-30)
What about aes-ctr?
Depends a bit on the MAC. CTR-EtM is technically vulnerable (i.e. cryptographically broken), but due to key stream desynchronization the attack will quickly lead to application errors, defeating the attacker. See Sect. 4.3.3.