With the changes introduced in https://github.com/ezsystems/ezpublish-kernel/pull/2035 the SPI\Limitation\Type::getCriterion() method now returns either API\Repository\Values\Content\Query\CriterionInterface or API\Repository\Values\Content\Query\Criterion\LogicalOperator (previously it was CriterionInterface only).
This change was done due to the fact that one of the Type's implementation, Core\Limitation\ObjectStateLimitationType needed to return API\Repository\Values\Content\Query\Criterion\LogicalAnd there in some cases. LogicalAnd extends LogicalOperator which in turn extends API\Repository\Values\Content\Query\Criterion class, but neither of them is implementing the CriterionInterface.
Other criteria, such as API\Repository\Values\Content\Query\Criterion\ContentTypeIdentifier extend the same Criterion, but also explicitly implement CriterionInterface.

To fix this, we need a slight BC break (hence the 7.0 kernel as a target). Quote from the PR:

If we want to fix this it seems it will need a slight bc break by introducing sub interfaces of CriterionInterface, one for logical operators (with for instance getCriterion() and constants for the supported logical operators and method to return the one for sub class) and another one for attributes or whatever we call it and move (slight BC break) getSpecifications() to that one. See the following java classes for examples on that.