For such a widely used piece of data like a URI, surely we must have water tight specifications right?

According to RFC 3986: Uniform Resource Identifier (URI) (2005) + is a reserved character which, if not used as a delimiter, must be percent-encoded as %2B.