I didn't realise that the recommendation had gone back the other way again; any good resources discussing current recommendations and the whys?

We have a fair bit of legacy stuff hanging around, all nginx+php, none of which appear to be vulnerable due to consistent use of try_files.