There is no reason for an IS to ever handle plaintext 3PIDs when doing a lookup; from a privacy perspective we should hash them.