Merged with
https://www.vaultwiki.org/issues/5805/
The example you posted is easier to reproduce and more visually apparent. Based on my understanding of the underlying issue, this occurs whenever a template parameter is used in the option value of any BB-Code, where that BB-Code's option is not wrapped in quotes.
This is because in the absence of quotes, the option is expected to end at the next closing bracket ].
When there is a nested BB-Code in the option, the nested BB-Code's closing bracket occurs first, which causes problems.
Even if a template parameter contains only text and no BB-Codes, it still might contain BB-Codes in a different usage of the template. Also, all template parameters are turned into fake BB-Codes anyway where the replacement HTML is the parsed value of the content that was entered into the template call.
Thus, best practice would be to quote-wrap any BB-Code options in templates if those options use template parameters.
We may be able to work around this issue by trying to catch when a valid tag appears in a BB-Code option, and assuming that the tag option has not completed in that case. This may be easier to achieve in some platforms than others, if possible at all. This may be a technical limitation.