Well, that’s actually a bit confusing. Here’s the breakdown:
The standard says that this should work:
<link rel="icon" href="https://example.com/images/favicon.ext" type="image/whatever" />
You can use any sort of image as long as you use the right MIME type.
However, certain older browsers (IE) can’t deal with anything but ICO files. And certain older browsers (again, IE) expect “shortcut icon”. And then certain older browsers (do you see where I’m going with this?) can’t deal with “image/vnd.microsoft.icon” types. And then again, certain older browsers (sigh) can’t handle anything but “favicon.ico” in the root directory of the site.
For full compatibility, this always works:
<link rel="shortcut icon" href="https://example.com/favicon.ico" type="image/x-icon" />
If you don’t care about anything older than current browsers, using just “icon” and any image file type in any location will work fine.
Note that specifying two different icons is not recommended in any case, because then it’s confusing.