It turns out the `update_post_meta()` method doesn't do any sanitization of the parent and child terms beyond the `_parse_terms()` call in the `save_post()` method in the admin class https://github.com/borkweb/scriblio-authority/blob/master/components/class-authority-posttype-admin.php#L447 .

That's worthy of a separate bug.