As an example of this sort of thing, Let's Encrypt adds a randomly generated field to its ACME responses, to force clients to properly ignore unrecognised fields: https://acme-v02.api.letsencrypt.org/directory

The contents of this field link here: https://community.letsencrypt.org/t/adding-random-entries-to...

I think Let's Encrypt have the right idea. I honestly don't think that trying to tip-toe around poorly written code is generally the right thing to do; it seems more like the UK Government is prioritising short-term security (trying to block "bad data", whatever that even is) over long-term security (forcing people to write better code).