Should Azure AD B2C User Flows still reject passwords containing the substring ".@"?

Question

According to the Azure AD B2C password complexity documentation (http://aka.ms/b2cpasswordcomplexity), passwords can contain "any letter, number, or symbol".

However, if I try to use, say, a Sign up User flow to create an account, passwords containing the substring ".@" are rejected (with a slightly misleading error message). The root cause seems to be that cpimcore.onmicrosoft.com's 'B2CTrustFrameworkBaseV2' policies still use (in the 'AllowedAADCharacters' predicate) a regexp that excludes ".@" (see (?!@)).

In the past, Azure AD strong passwords could not contain the substring ".@" (https://msdn.microsoft.com/en-us/library/azure/jj943764.aspx#password-policies-that-apply-only-to-cloud-user-accounts). Today, this restriction is conspicuously absent (https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#password-policies-that-only-apply-to-cloud-user-accounts); also, if I work around the below issue, I can successfully create Azure AD B2C accounts with passwords containing the substring ".@", so it looks like that absence is intentional.

Reproduction:

• In Azure Portal, go to the overview page for Azure AD B2C (for some regular tenant that is set up to run User flows).
• Go to User flows.
• Use an existing e.g. Sign up User flow with Strong password complexity.
  OR
  Create a new User flow.
  • Select New user flow. Select e.g. Sign up, select Recommended and select Create.
  • Enter name e.g. 'pwdtest', select Email signup and select Create.
• Select the user flow and select Run user flow. Select Run user flow.
• Enter an accessbile e-mail address. Select Send verification code. When the code arrives, enter it and select Verify code.
• Enter twice a valid password containing ".@" e.g. "Aaaaaaa0.@"
• Select Create. Both password boxes are annotated with the error message "An invalid character was provided.". <- BUG?

Expected behaviour:

• Sign up (and password reset) should accept passwords containing the substring ".@".