Hayes modems required the pause around +++ as a measure to avoid race conditions around data that might be in the inbound or outbound buffers during the switch

Hayes modems required the pause around +++ as a measure to avoid race conditions around data that might be in the inbound or outbound buffers during the switch to command mode. However, there are a number of modems (including in my experience basically all modern modems) that do not enforce the pause requirement and are happy to receive a command immediately following, e.g. +++<CR>ATDT can be sent with no problems on a modern Telit module I'm using. So in practice this was not really an effective mitigation to problems around the +++ switch to command mode and it remained an exploitable security issue for some time in the '90s.