Your vendor probably meant that colons aren't great to use in URLs because they are part of RFC 3986's reserved characters, since colon has a special meaning in the URL.
Technically, since colon has no special meaning as part of the URL query string, they don't need to be URL-encoded. However, Firefox is strict, and URL-encodes it anyway when typed /pasted into the address bar.
What's more, if your marketer is building and testing the URL in Firefox, and copies it from the address bar, it will preserve that encoding, so now if they paste it into a page, all users will come through with %3A.
So, it's not totally safe to use colons - they may come through in a couple of different formats.
We used to use a colon, but recently switched to a pipe. We had too many instances where an author would use a colon for something else, such as a subject line and screw up our tracking. We haven't seen errant pipes...yet.
Yes I had a vendor tell us we were using unsafe characters for www.test.com?ecid=test:test:test on theiremail system (They add their own tracking and its conflicting with our parameters)
I was surprised they thought colons were unsafe. Since I have learned about them since I started in marketing. I'm glad I have the support of this forum to back up that colons are a good practice for campaign query parameters.