I can confirm that moving site (gracefully) invalidates reference to the site in workspaces. But even with invalid references in workspace, I still cannot reproduce the bug you are experiencing. I could send you a debug version to trace this. But its log will obviously contain data of all your sites.

Ok, this thing really drove me crazy. I was exporting, importing, deleting sites etc. Those subfolders kept appearing.
At least I have a suggestion where to look.
I have stored workspaces. And those contain sites which I have later arranged in a directory tree.
I think the problem is that every time I import, this workspace somehow causes a restore of the previously moved sites.
I noticed that clicking on the stored workspace did not show any sites in the list.
Perhaps the bug is that during the rearrangement of sites into a tree, the stored workspaces are becoming illegal and WinSCP doesn't acknowledge this.
Can you please, confirm there is an issue with this?

I am afraid I can not give you my production file.
I tried everything, but even deleting one single link from it, exporting, and then importing it back - works properly.
Any suggestions? I really want to help get this bug fixed as many of my colleagues import the same file and it is cumbersome to go delete two folders every time.

Thanks for your report. Though I was not able to reproduce it.

Can you try to setup a minimal example INI file that causes this when importing?

I'm doing an export/backup configuration and import from one and the same version of WinSCP.
My sites have a tree with subfolders.
During import two of my subfolders are duplicated but on a main level:
Real structure:
AIX
-DB
-AS
Imported (wrong structure)
AIX
-DB
-AS
DB
AS