There would be security issues if any existing website has put confidential user data after the #, expecting that no other website would see this in the referer

There would be security issues if any existing website has put confidential user data after the #, expecting that no other website would see this in the referers. This doesn't seem typical, but still I'm sure some websites would have security issues if this was changed. Also, practically speaking, even if all browser developers agree this was a good thing, it takes quite a long time for people to upgrade their browsers.