Archive-provided pathnames may appear in error strings - some examples in #1609, and in particular #1609 (comment).
The change in #1609 improved an error message, to address issue #1561. In addition the change switched one case that printed an error string from safe_fprintf to fprintf. That case was switched back to safe_fprintf in #2101. There are however a number of other code paths that print error strings without escaping, via lafe_errc or lafe_warnc (and are completely independent of the changes in #1609).
As @jsonn suggests in #1609 (comment) we may consider escaping these when adding them to an error string.