I've taken a look at this and it seems the issue is the Bluez updates due to CVE-2023-45866 (as I said initially).
This will likely affect any (old) gamepad which doesn't encrypt the comunication with the host. The workaround is suggested in the linked Ubuntu bug report:
Set ClassicBondedOnly=false in /etc/bluetooth/input.conf
Run sudo systemctl restart bluetooth or reboot
Possibly other gamepads affected - the Wii U Pro Controller (haven't tested it yet).
NB: this issue is not restricted to Raspberry Pi, it affects any platform where Bluez was patched for CVE-2023-45866.