One security concern is that the filenames for recursive transfers are determined by the untrusted machine. Thus if you fail to validate those, they could send

One security concern is that the filenames for recursive transfers are determined by the untrusted machine. Thus if you fail to validate those, they could send things like ../.bashrc and a naive tool would write that to your home directory, leading to remote code execution. Presumably by now scp is sufficiently tested not to have this bug. But this is precisely a defense against an evil server sending bad bytes.