We have an LTI 1.3 tool provider that receives roster information via LTI Names and Roles Provisioning Service. The JSON response contains a list of objects with email addresses in the "email" key. We have one customer using Moodle 3.11.11 (this version wasn't available in the dropdown) where the email addresses we receive are HTML-encoded. 

MDL-75453 is a very similar issue although we are noticing that other characters (even just plain letters) are being encoded with their HTML entities instead of being sent in plain text.