The email field is not being properly validated.

If I remember correctly this works as expected according to standards → .

Added a patch to validate the "email" input field in `WebformSubmissionForm::copyFormValuesToEntity()` using `filter_var()`.
If the email format is invalid, an error message is shown using `$form_state->setErrorByName()`

The steps to reproduce are not reproducible on a modern web browser. It is a type="email" field. Modern browsers won't let users post the form without a valid email.

I think your patch would only work if the field is called "email".