I think you were right about the backupctrl issue being related.
I think it was caused by a change issued in CU164 which changed the backup include and exclude files to have their entries as relative paths and not absolute paths. I think that may have then caused the backupctrl issue.
Either way, changing the include file paths back to absolute (ie prepending a / at the start of every line) has made my backup now include all the required directories.
I will have a look at testing out the path change that @Michael implemented to fix the backupctrl issue to confirm if that also fixes this problem - ie they are driven by the same root cause. However I will over to my vm testbed for that because I will have to copy in the modified backupctrl file from the git repository and the path change was made to one of the c files for backupctrl.
Anyway a simple temp fix for your running system is to add a / at the start of each line in
/var/ipfire/backup/include