I got thrown for a loop since the username is uri-escaped but the password was not.

I got thrown for another couple of loops due to the multiple levels of interpretation involved:
1) JSON syntax requires backslashes to be slash-escaped. Some vCenter deployments use windows domain-style usernames DOMAIN\user
2) the OVFTOOL docs specify that "all special characters" be uri-encoded when part of the user name or password
3) different shell interpretations on windows/linux

I'd say escape both or neither.