I agree * is unsafe, but then again ssh devs chose to include it so that means they deemed it not completely useless, thus there are probably enough people who use it to make this thread somewhat malicious.

Also if you or another script once added * to your .ssh/config long ago it may still be lurking there among other lines without you realizing.

I agree checking fingerprints helps, but that can turned off pretty easily too.