Drupal Community Portal

Hello All,
I have been using arg() function (example arg(0), arg(1)) for many years without realizing that it is unsecured from XSS attacks and it needs to be enclosed within check_plain() to make it sage.
It seems following function is unsecure and we should enclose $_GET['q'] with check_plain():
function arg($index = NULL, $path = NULL) {
static $arguments;
if (!isset($path)) {
$path =$_GET['q'];
}
if (!isset($arguments[$path])) {
$arguments[$path] = explode('/', $path);
}
if (!isset($index)) {
return $arguments[$path];
}
if (isset($arguments[$path][$index])) {
return $arguments[$path][$index];
}
}
as follows for XSS attack prevention:
function arg($index = NULL, $path = NULL) {
static $arguments;
if (!isset($path)) {
$path =check_plain($_GET['q']);
}
if (!isset($arguments[$path])) {
$arguments[$path] = explode('/', $path);
}
if (!isset($index)) {
return $arguments[$path];
}
if (isset($arguments[$path][$index])) {
return $arguments[$path][$index];
}
}
Any reason why we do not put check_plain here and leave it for developers to enclose their args with check_plain?
thanks a lot,
Sudeep