Do you have the dataroot config variable set in settings.php? If yes, this might explain why the problem also occurs without the sysmlink variable.
Don't ask me about the exact handling of caching with/without the dataroot variable defined. I only remember that I had an issue with MultiViews in Apache causing the CKEditor to fail both with the cache sysmlink and/or the dataroot variable defined but not without either of them used. I don't know if nginx has anything corresponding to Apache's MultiViews. If yes, it might help to disable the corresponding functionality (as I do now in .htaccess to override any global Apache config of MultiViews).
i did have the dataroot variable set in settings.php, yes. i just removed that and then removed the directive for js/css files in my nginx config but there is a confusing pattern emerging. i am now seeing that js and css files are being served with a 6 month expires value regardless of whether the dataroot value is set or not and regardless of whether i apply an nginx directive to js and css files.
my only explanation for this at present is that when i initially removed the symlink there was some kind of delay in the system that meant that initially the expires parameter was not applied.
Security issues should be reported to firstname.lastname@example.org!