In default Debian, sh is a link to dash (not bash). Dash fits more closely the POSIX behavior for "Brace Expansion".
Bash has this documented difference with historical sh (from man bash):
Brace expansion introduces a slight incompatibility with historical versions of sh. sh does not treat opening or closing braces specially when they appear as part of a word, and preserves them in the output. Bash removes braces from words as a consequence of brace expansion. For example, a word entered to sh as file{1,2} appears identically in the output. The same word is output as file1 file2 after expansion by bash. If strict compatibility with sh is desired, start bash with the +B option or disable brace expansion with the +B option to the set command.
Either of this work:
bash +B -c 'echo {a,b,c}'
bash -c 'set +B; echo {a,b,c}'
And, if you still need a more POSIXly bash:
bash --posix +B -c 'echo {a,b,c}'
bash --posix -c 'set +B; echo {a,b,c}'
As changing the default shell for /bin/sh has many system wide consequences, I do not recommend you to change /bin/sh to dash.
However, it is usual that $HOME/bin/ (or a.k.a ~/bin/) is set ahead of /bin/ in the PATH. So, you could copy a dash executable to your user ~/bin/sh (or even a symbolic or real link) and dash will work as the default sh for that user.
Sometimes the inclusion of ~/bin/ as user executable programs is done in .profile:
[ -d "${HOME}/bin" ] && export PATH="${HOME}/bin:$PATH"
which is sourced by (almost any shell) bash on the first login (at server X start time for the user) and from then on it exists as an environment value.
If that exists, all you have to do is create the /home/$USER/bin directory.
Of course, you need to login back again or source ~/.profile once.