Order by 1 shortens the result set to one row
Is this a bug in SQL Server?


No.

From PRB: Execution Plan and Results of Aggregate Concatenation Queries Depend Upon Expression Location


  The correct behavior for an aggregate concatenation query is
  undefined.


See also this excellent answer by Martin Smith over at stackoverflow.
nvarchar concatenation / index / nvarchar(max) inexplicable behavior

Sometimes it works and sometimes it does not work and that is dependent on the execution plan. The magic works if the compute scalar doing the concatenation is positioned as the first operator below the select operator.

declare @T table(Name nvarchar(5));
insert into @T values (N'aaaa3'),(N'bbbb2'),(N'cccc1');
declare @S nvarchar(18) = N'';

select @S += ',' + T.Name
from @T as T;




But if you are unlucky you could end up with a different plan. This one has a sort operator between the select and the compute scalar.

select @S += ',' + T.Name
from @T as T
order by reverse(T.Name);




The best way to solve this (in my opinion) is to use for xml path to do the concatenation instead.

select @S  = (
             select ',' + T.Name 
             from @T as T
             order by reverse(T.Name)
             for xml path(''), type
             ).value('text()[1]', 'nvarchar(max)');


Some version of SQL Server in the future will have a built in string aggregate function STRING_AGG (Transact-SQL).