Globbing is possible but unwise. You do want a variable with an explicit list of sources, even while trying to make things as automatic and dynamic as possible.
In decades of programming in very varied environments I have never compiled any software project otherwise than by using globbing, so that I have never needed to waste time to write the name of any source file in a Makefile.
I have never seen any reason to do otherwise.
For instance, using special compilation flags for a certain source file, different from the others, is something that I consider a mistake. Whichever is the goal, it certainly can be achieved by other means (e.g. pragmas or attributes).
Moreover, the dependencies for any file must always be generated automatically, they must never be written explicitly, which removes the main reason why in bad Makefiles the names of the source files are written individually.
You must also be aware that they are compiled in a different way and you must search a frequently too big and obfuscated Makefile to discover which is the applicable compilation rule.
Unfortunately I have seen many projects that had used such tricks and it was always painful for maintenance to discover how they were supposed to work.
Once you start getting to multiple directories and recursive scans, the build time begins to grow enormously and usually unexpectedly.
Not a problem at all for small or even medium size projects on a fast machine.
But once you start building very large projects with multiple sub-projects, it generally slows the machine to a crawl on every build.
The bigger a project is, the more important is to use only globbing and never write explicitly any file name lists.
However, I believe that this, the slowness of globbing for big directories, might be a strictly Windows-specific problem, if it exists. At least on Linux and with XFS (which has B-tree directories) I have never seen globbing to take any noticeable time, even on directories with ten thousand files or more, where it still appears to be instantaneous at the human reaction time scale.
There is no reason to ever do recursive scans. All the directories with source files of a project must be scanned to search for any source files located there, but only once.
Globbing is a security and reliability hole. You don't ever really know what got included or will get included, you just assume you do, and you are right only most of the time and only by luck not by actually ensuring it.
Saying things like "only the files I expect should ever be in this dir" is just wrong swiss cheese thinking. (you never said that, but another commenter essentially did)
Alternatively, you could move such a file to a subdirectory "Attic" or the like.
Any of these solutions would ensure that globbing will no longer include that file in the list of source files, without needing to update any project configuration files.