When I worked at one of the tech giants that develops a certain suite of office apps, the C++ class they used to model URLs in the cross platform layer had a flaw around escaped characters. I worked in the group that developed the iOS/macOS versions of the apps and we had a number of kludges in place to deal with conversion between these C++ classes and NSURL and CFURL. In my time on different occasions devs discovered the flaws and composed lengthy emails explaining the fixes that needed to be made, but the C++ class was too entrenched to be fixed. That was about 5 years ago, I doubt it has changed.