While working on MDL-52831 I noticed that in the signup form, we use PARAM_TEXT for fields like lastname and firstname. But those fields are correctly considered as PARAM_NOTAGS when editing the user profile later.

It is not urgent and it should not represent a security issue. In theory it can led to situation when a user registers themselves with names using multi-lang filter syntax and there might be a code that uses format_string() to display the name. It is not common though.

In any case, these parameters should be consistent in all three forms (signup, edit and editadvanced).

poltawski pointed me to an issue MDL-52781 that aims to provide a single place to define these things which sounds like a proper solution. Meanwhile, I am suggesting to just fix the signup form to be consistent with user profile forms.