I take it that "server" in this context includes the remote party in a "serverless" transfer. I mean, I take it this isn't particular to the rsync daemon.

It sounds like a very serious defect, very easy to exploit. It needed to be addressed quickly. I'm not surprised they skipped the code review.

>rsync is not the right tool for the job if you do not trust the server

Why would you ever trust the server not to do bad things?

I do trust my own server not to misbehave, but I probably would not trust some random server on the internet.

I've had personal servers compromised. I don't unconditionally trust them either.

Exactly. I'm usually worried about the opposite scenario (the client infecting the server). If you're copying files from a personal computer it might have all sorts of random software running on it that's accumulated over the years. Whereas on a remote server you tend to have a better security posture, and aren't installing random software and apps. Admittedly, that might just be my personal use case though.

Or if you can't stand mail-archive.com:

https://lists.samba.org/archive/rsync/2022-March/032769.html