I have pushed out a new version of the Tag Group plugin with most changes being probably invisible for most users.
Although I cannot imagine any scenario how the usage of add_query_arg() and remove_query_arg() could cause any harm (since the second parameter is not empty), I have nevertheless decided to escape the values as recommended. Additionally, I noticed a regression bug caused by the last update, 0.17.2. And, since I was already on it, I also made the drop-down menu for bulk changes more user-friendly, realized that it could as well be at the bottom of the list, and discovered a wrong confirmation message – an unfixed remainder from 0.17.2.
The result is available as version 0.18.