For example, how could it know whether cat $foo should be cat "$foo", or whether the script actually relies on word splitting? It's possible that $foo intentionally contains multiple paths.

Last time I used ShellCheck (yesterday funnily enough) I had written ports+=($(get_elixir_ports)) to split the input since get_elixir_ports returns a string of space separated ports. It worked exactly as intended, but ShellCheck still recommended to make the splitting explicit rather than implicit.

The ShellCheck docs recommended

IFS=" " read -r -a elixir_ports <<< "(get_elixir_ports)"
ports+=("${elixir_ports[@]}")