The cmd /? help page says that the special characters that require quotes are:

<space>
&()[]{}^=;!'+,`~

So, this might be a reasonable solution:

--- a/src/lint/linter/ArcanistExternalLinter.php
+++ b/src/lint/linter/ArcanistExternalLinter.php
@@ -321,9 +321,9 @@ abstract class ArcanistExternalLinter extends ArcanistFutureLinter {
     $binary = $this->getBinary();

     if ($interpreter) {
-      $bin = csprintf('%s %s', $interpreter, $binary);
+      $bin = csprintf('%R %s', $interpreter, $binary);
     } else {
-      $bin = csprintf('%s', $binary);
+      $bin = csprintf('%R', $binary);
     }

     return $bin;

Summary of a conversation I had about this with @epriestley on IRC:

Critique 1: %R has the same behavior as %s in some cases. Offhand, the binary path may very reasonably have spaces in it, if it's entered as "C:/Program FIles (x86)/Node/bin/jshint" or whatever.
Response: When a path is specified, the quotes are fine. The only case in which the quotes are not fine is executable names that are looked up in $PATH, such as "jshint".

Critique 2: Since we haven't seen much in the way of reports, either no users are interested in doing that or it's working fine for many of them. If it's completely broken and no one cares, that makes it even less important to fix.
Response: To run into this, people have to be:

1. Developing on Windows.
2. Using Differential.
3. Using arcanist for linting.
4. Specifically using node.js-based linters, for which npm generates batch-based wrappers that use %~dp0.

Each one of those will weed some people out, so the impacted group is certainly a minority. And there are certainly workarounds, such as using full paths, or adding shims to the repo, but they're annoying and tiresome for something that could have easily "just worked".

The patch I provided makes it "just work", and, I believe, has no downsides.