That should absolutely match hidden files. The / at the end of the source says "every file under this directory". Nevertheless, testing and research bear you out. This is stupid behavior.
The "answer" is to append a dot to the end of the source:
scp -rp src/. user@server:dest/
The real answer is to use rsync.
Well, as far as the -exec syntax goes, you could do like a lot of people, give up and use xargs:
find . -type f | xargs chown username
(or the files-with-spaces-and-other-nonsense-in-them-safe version)
find . -type f -print0 | xargs -0 chown username
Or, to try to remember the right thing to do with the semicolon, what you need to drill into your head is that you're using a semicolon to terminate the command that -exec is running, and you have to escape the semicolon because it has special meaning to bash. Which is why it's backslash semicolon. You seem to have the {} substitution part okay.
As to killing files and so on, if you're running something big and dangerous like you're talking about, first do this:
find . -type f -exec echo chown username {} \;
and review the results. This is basically a "dry run" where you're seeing the commands it would run if you let it. Definitely a good practice. Won't help with the .* problem, but you know not to do that one now. :)
Best Answer
What is the output of
alias ls? It sounds like the folder is being created but you expect it to be hidden when you do als. Perhaps yourlsis aliased tols -a?