From my (still) very limited understanding, and from tracking down some code paths emanating from WikibaseCirrusSearch's buildEntitySearchQuery any search term santization (especially with regards to reserved chars) is either irrelevant - due to the fact that the used query builders rely on match and it's variants, and none seem to be using the "scary" query_string builder - or appears to be handled in various ways in CirrusSearch (which is where they probably should be handled any way).

I didn't get around to chat with anyone in the search team about this, and my mental model of how ElasticSearch works is probably still a bit misconceived, so I'd be happy for any better quality information or corrections if you have them. Regardless, it seems safe to me to remove this task from our board, since nothing imminent seems to be exploding.