Looking at this further, the whole issue (probably) stems from the url_for_vendor filter
Shopify was trying to be useful by creating an automatic collection-like page for vendors, and haphazardly allowed the q parameter to be used for the collection title.
So, the platform fix should be to validate that the vendor name passed to q actually exists before outputting it to the page. Additionally, /vendors/ should 404 if no vendors are in the product catalog.