Okay, found it.
The behavior change happens when KB4534273 (a recent update for 1809) is installed.
Git Bash starts formatting the single-quoted part as a single argument (as it should) and treating /c as a path (as it usually does) – which it didn’t do before for some reason. So in fact, what you see now is the correct behavior.
As such, cmd /C '"C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" amd64 && <etc>' turns into C:\Windows\system32\cmd.exe C:/ "\"C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\VC\Auxiliary\Build\vcvarsall.bat\" amd64 && <etc>" argument for CreateProcess.
Since Cmd, unlike Bash, expects the code on the command line to not be a single argument but multiple, one for each lexeme, you need to represent it accordingly as multiple arguments, quoting Bash special syntax as necessary (and also prevent treating /c as path):
cmd.exe //C 'C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\VC\Auxiliary\Build\vcvarsall.bat' amd64 '&&' <etc>