Security wholes you only make yourself. If properly used it doesnt matter which bytes they use. Split is doing its job well... if needed. The thing you probably wanted to do is:
[join [lrange [split $arg] 1 end]]
or equivalent one:
[join [lreplace [split $arg] 0 0]]
or without any list functions:
[string range $arg [expr {[string first " " $arg] + 1}] end]