Function Arg() to be made XSS secure

I made a posting here http://drupal.org/node/1448714, but reazlied it would be ideal to follow security team on email as well.

I have been using arg() function (example arg(0), arg(1)) for many years without realizing that it is unsecured from XSS attacks and it needs to be enclosed within check_plain() to make it sane.

It seems following function is unsecure and we should enclose $_GET['q'] with check_plain() in Drupal Core itself.

function arg($index = NULL, $path = NULL) {
static $arguments;

if (!isset($path)) {
$path =$_GET['q'];
}
if (!isset($arguments[$path])) {
$arguments[$path] = explode('/', $path);
}
if (!isset($index)) {
return $arguments[$path];
}
if (isset($arguments[$path][$index])) {
return $arguments[$path][$index];
}
}

as follows for XSS attack prevention:

function arg($index = NULL, $path = NULL) {
static $arguments;

if (!isset($path)) {
$path =check_plain($_GET['q']);
}
if (!isset($arguments[$path])) {
$arguments[$path] = explode('/', $path);
}
if (!isset($index)) {
return $arguments[$path];
}
if (isset($arguments[$path][$index])) {
return $arguments[$path][$index];
}
}

Any reason why we do not put check_plain here and leave it for developers to enclose their args with check_plain?

thanks a lot,
Sudeep