They've gone back and forth on this. It is a serious security issue, but for people who regularly use non-ascii characters, it's a usability issue. A blacklist might be a usable compromise, but I bet it would feel terribly confusing - in part because of font variability.