You can set an oper vhost with a space in it, which is protocol-breaking:
@time=2021-06-29T12:36:29.013Z;msgid=ykih9r6gcqtv6qaipdiqcrrvr6 :asdf!~u@for all intents and purposes PRIVMSG #xyz :hi
I think this came up previously? Anyway, this should probably just be validated against vhosts.valid-regex even when user-set vhosts are disabled.