REPLICATE() return type for VARBINARY input
I suspect that REPLICATE is expecting a string not a binary type, and an implicit conversion is taking place from VARBINARY to VARCHAR. If you update your example like so you get the expected type:

declare @vb nvarchar(10) = '#'
declare @res sql_variant = REPLICATE(@vb, 2)
SELECT sql_variant_property(@res, 'BaseType')


Even though it accepts a binary input, the spec does specifically state that parameter is a "string expression" which is why I suspect type coercion is happening before the function is actually run. By "expected type" I am referring to it not being fixed as VARCHAR irrespective of input type which might be implied when looking in your result on its own. So I think the documentation is correct, but perhaps not perfectly clear: the function returns the same [N][VAR]CHAR(&lt;len&gt;) type that is receives, and in your test it is receiving a VARCHAR() due to implicit conversion from VARBINARY to VARCHAR.