By not supporting Unicode-aware character classes

Well, tr/// doesn't support character classes in general (only certain kind of ranges), so this is not specifically a Unicode problem, but a feature of tr///.   (I'd agree if you had said "tr and character classes don't mix well"...)

What you're pointing out is kind of a different problem, i.e. doing sanitization based on picking out an incomplete list of individual characters as opposed to using a catch-all character class.