Potential security hole? Check plain user input "match"?

Wouldn't it make sense to check_plain() the $match Variable in videojs_filter.module on line 161?

Currently the content of the filter tags is used without any security checks, as it seems and that might be a potential security hole in my eyes, because users may input dangerous code into the videojs content.
May someone else have at look at that perhaps?

My suggestion is simple:

  foreach ($matches[0] as $match) {
    $attr = array();
    $file = array();
    $orig_match[] = $match;
// Modification here:
    $match = str_replace(array('[', ']', '{', '}'), '', check_plain($match));
    $options = explode('|', $match);