It's true that we currently don't enforce the SEF settings when parsing the URLs. That's not only the case for the suffixes, you also can always access a page using non-SEF URLs.
I honestly don't know if that will change with the new routing. If it does, it will likely just generate a 404. You will not get a redirect because the URL technically is invalid.

But then, it's not a real issue. While you get multiple URLs pointing to the same page, contrary to popular believe Google does not consider that a duplicate content.
Also, links generated will always have the suffix, and that is what Google indexes.

The problem we have seen is google is listing the pages under both accessible urls, thus duplicate URLS and accessing in Google. We had the same with the http to https move, google indexes both separately.

Really it should be a 404. At the moment, we can handle it with htaccess redirects. But for end users this is not at all practical.

If Google finds them, then the question is more where the links are coming from.
Sure, Google will index both, but afaik it will detect them as the same page and only list one in the search result. Ideally we would always add a proper canonical tag, so Google knows which one is the "right" URL. That's what Google suggest themself.

Generating 404 imho is the worst choice, since it leaves users following those links on an error page. That's not going to bring you good conversion rates ?

Well, prime example. Migrated a client from an old wordpress site to Joomla! Google has their urls and we matched them but using the suffix. Joomla! allows both. so we redirect, yes we could just set to no suffix, but that's not the point here.

Google indexes our new sitemap, still has the old links. People linking still have the old links.

Generating a 404 is better as you can use com_redirects to redirect them then, which is intuitive. Whereas ways to access content you have no way of knowing easily how they access the page.

It was listing both for us.

In that use case you should not have added the suffix :)

I didn't build it, it's how the builders did it. But it's what they always and have.

Regardless, this is off topic. The end point is, we shouldn't allow multiple URLS to access a single page, if suffix is enabled and it is a valid menu item we should add the suffix on 301 redirect.

agree that that would be the desired approach

There is already an open issue for this in the 4.0 projects if someone wants to tackle it. It won't be a fix made in 3.x.

And you didn't even link to it! ? Cool will check out the issue

There's only so much I can do on a cell phone. I know the issue is there but searching for it isn't easy on the mobile interface.

Found the other issue #15025 so closing this one