I think what's most notable is that the question mark, the ampersand and the percent sign are not being escaped and could make the query string unparsable for some web servers. Also, if a custom parameter contains a pound sign, everything after it will be considered a fragment and not used for the click URL. Like I mentioned before, we URL-encode all custom parameters before sending them to the API, so it's not a problem for us. But it might be helpful if the behavior was documented.
Thanks again and best regards,
Dorian