Yeah, this is the relevant customization with the last one listed being removed being my workaround:

KexAlgorithms -diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

I believe the hardening came from ssh-audit, the version I'm using currently flags that algorithm:

ssh-audit v3.3.0, <https://github.com/jtesta/ssh-audit>

The snippet of the finding when the workaround is applied:

(kex) ecdh-sha2-nistp521                  -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
                                          `- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62