So uhh, you can also escape the wildcard with '\*' on the local shell if that's how you're initiating the rsync e.g.

rsync -avzh --progress [email protected]:/home/joe/pictures/\*.jpg ./pictures/

That keeps the local shell from expanding the wildcard and the remote host will then honor it. Certainly a lot simpler than the insane include/exclude gymnastics above. Good enough for simple jobs.