As it turns out, you kind of need the user slug for things like autocomplete. We already do similar for posts with exposing the slug in embed, and it's already available in the URL, so there's no real privacy or consistency concerns (apart from being more consistent).