Basically scp logged you into the remote system just like ssh and spawned an process through a command pipe.

For one thing, this completely eliminated the ability to separate "user can run program on remote system" from a much more limited "can send/receive a file".

It's like if nfs access to a filesystem required the ability to log into the remote system.

I'm glad this seems to have been sort of addressed. I don't know if it allows more sane filesystem-access-only ssh access to a system.