"Due to inaccurate information within the WordPress codex, a number of developers improperly assumed the add_query_arg() and remove_query_arg() functions would properly escape user input."

How exactly was the codex wrong? Just because it didn't say to use esc_url does it mean that it was wrong? There are hundreds of examples in WordPress that use esc_url and its been a common practice in themes and plugins for quite some time.