I think a lot of those writing software just escape [^a-zA-Z0-9-_\.] or similar just to be overly cautious. I've definitely been guilty of this myself when I'm in a rush.

I'm also the person who gets irrationally annoyed at web forms that barf at my username+tag@example.com email address usage (+ signs being valid in the username part), so I can certainly relate to the ire, too.

It's a special character in HTML, which is the context in which the name is being shown. The fact that it's escaped before being concatenated into the HTML document is fine; the fact that it's triple-escaped is the problem.