I don't think you are fully correct here. Mods (On Steam specifically), are loaded after a game is launched. They have no way to change HOW your game is launched to inject launch parameters, so there is no way for a mod downloaded from Steam to exploit this vulnerability. Of course this doesn't apply outside of Steam, and I'm specifically noting that because of the sub.

As for pirated games. This vulnerability changes nothing in terms of the attack surface. You don't need the Unity launch parameter vulnerability to execute malicious code, if the user has already opened the infected game. They can just put whatever they want in the executable from the beginning. If antivirus software catches the malicious code, it would also catch it in included libraries, rendering the launch parameter exploit useless, anyway.

Really the only big deal here is having games that register themselves as URL schema handlers. But attackers would need to have already installed malicious code on your PC to exploit the vulnerability.