Forgive my ignorance, but would it be easier if add_query_arg() and remove_query_arg() functions are modified in the core to properly escape user input then do a core security update?