The problem is that in practice things that implement RFC3986 do random things with stuff that is invalid instead of rejecting it, in an attempt to comply with

The problem is that in practice things that implement RFC3986 do random things with stuff that is invalid instead of rejecting it, in an attempt to comply with Postel's law. So, again in practice, the security consequence of implementing RFC3986 is typically much worse than that of implementing the WHATWG URL spec. At least the latter actually defines handling for all inputs, instead of leaving implementations to make things up as they go.