I guess if they aren’t diligent with encoding urls that could be an attack vector because it separates query parameters.