Sitelinks Search Box in Google and urlencoded search string

I can confirm that url-decoding the search query is the correct approach. In fact, it is done in WordPress core for the search parameter of WP_Query but not when the search string is from a $_GET request as it is seen in WP_Query::parse_search() method, wp-includes/query.php#L2061 (WP 4.2.2):

if ( empty( $_GET['s'] ) && $this->is_main_query() )
    $q['s'] = urldecode( $q['s'] );

Later within the same method, the search phrase is scaped. So, the search string from Google SearchBox must be urldecoded and it is safe:

add_action( 'pre_get_posts', function( $query ) {

    if( ! is_admin() && $query->is_search() && $query->is_main_query() ) {

        $query->set( 's', urldecode( $query->get( 's' ) ) );

    }

} );