I've figured it out.

I'd followed minads instructions for setting up corfu with lsp-mode, which configures the completion style for lsp-capf.

The problem with that is that lsp-mode configures its own lsp-passthrough style, which the above configuration then overwrites.

The reason why it breaks variable completion with the serenata language server (might not be the only one, but that what I have available) without lsp-passthrough, is that when completing $var, the server returns a completion with the label var_name, but
what's really inserted is $var_name. So when orderless (and other) completion styles get a candidate of var_name and see a prefix of $var they filter it out.

Removing the configuration from the wiki doesn't help, as that kills all variable filtering and just presents a popup with all the variables (makes sense, corfu lets the completion style handle filtering, and lsp-completion-passthrough-all-completions just
parses everything through). I guess company must do its own post-filtering for it to work.

This is not limited to corfu, vanilla completion-at-point has the same problems, as would any other completion front-end that doesn't know about lsp-mode.

I've read up on the PR #2975 and the issue #2970, which is what introduced lsp-passthrough, and it's clear there's different opinions on the importance of keeping to standard capf, and being able to take advantage of what the language server actually provides.

I've come up with a possible solution, see #3825

I guess company must do its own post-filtering for it to work.

Company restarts the Capf on every keypress, such that the language server is called again on every keypress. Therefore the passthrough style works for Company. Corfu works differently. It calls the Capf once, obtains the completion table and caches it. Then the candidates are filtered using the completions style. In case you want to emulate the Company behavior you can use the cape-capf-buster, which busts the cache and recalls the Capf on every keypress.

The advantages of the Corfu behavior are efficiency thanks to the cache and the flexibility offered by the completion styles. You can for example use Orderless filtering on the cached completion table. The downside is that you don't get immediate updates from the Lsp server, but you could use the cape-capf-buster if you prefer that and if you can live with the lower completion performance.

Closing this as the problem seems limited to the one server, which is minimally maintained these days anyway.