I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters.

I have read this answer which describes how that might be achieved (by overriding the form validation for creating/editing a user).

My question is: Would there be some security risk in allowing special characters such as &/#?()+ in usernames, or did the Drupal developers make these characters illegal purely for aesthetic reasons?