It even messes this up for +runscript paths. No matter how you quote them or escape the spaces.

SteamCMD's "help commandline" has this helpful bit:

-- Directly invoking commands at program execution time using the
command-line

This can be done using the '+' directive: Any command (including convars)
which you can type at the Steam> prompt may also be passed in via the
program command-line after the '+' character.

If the command takes more than one argument, you must wrap the entire
command (including the '+' character) in quotes. Additionally, if any
arguments include spaces, they should themselves be wrapped in quotes. In
the case where outer and inner quotes are necessary, escape the inner qotes
with the backslash ('\') character.

You can include as many '+' directives on the command-line as you want, they
will be executed sequentially in order.

Examples:

 * to invoke 'some_command' run:

        steamcmd +some_command

 * to invoke 'some_command arg1' run:

        steamcmd +some_command arg1

 * to invoke 'some_command arg1 arg2' run:

        steamcmd "+some_command arg1 arg2"

 * to invoke 'some_command arg1 "arg with spaces"' run:

        steamcmd "+some_command arg1 \"arg with spaces\""

In testing, steamcmd "+force_install_dir \"C:\Program Files (x86)\Steam\steamapps\common\Baldurs Gate 3\"" +login usernamegoeshere +app_update 1086940 validate +quit does indeed seem to correctly update Baldur's Gate 3 in the correct folder! I'll see about updating the wiki to help people with the syntax in the future.