I’m up-to-date but I still have this issue. I feel like the onus is a little more on WP than on SPO, but the only way I was able to resolve it was by removing the esc_url() from the function you changed, so:
$query_string = esc_url( remove_query_arg( array( 'orderby', 'order' ) ) );
becomes $query_string = remove_query_arg( array( 'orderby', 'order' ) );
There’s a whole bunch of escaping happening in the WP core, and I haven’t run into any issues from removing this. But I don’t know if it’s something that *everyone* would want to do — just a heads up for anybody dealing with this.