Bad request args trigger fatal error

An unauthorised scan of the site resulted in fatal errors:

PHP Fatal error:  Uncaught TypeError: Unsupported operand types: string + int in /var/www/html/wp-content/plugins/the-events-calendar/src/Tribe/Views/V2/View.php:1349

I can reproduce this with curl "http://localhost/events/list/?posts_per_page='15"

I can avoid the fatal error by forcing events_per_page to be an int.

--- a/src/Tribe/Views/V2/View.php
+++ b/src/Tribe/Views/V2/View.php
@@ -1346,7 +1346,7 @@ class View implements View_Interface {
                 * @since 5.0.0
                */
                $args = [
-                       'posts_per_page'       => $context_arr['events_per_page'] + 1,
+                       'posts_per_page'       => (int)$context_arr['events_per_page'] + 1,
                        'paged'                => max( Arr::get_first_set( array_filter( $context_arr ), [
                                'paged',
                                'page',
@@ -1415,7 +1415,7 @@ class View implements View_Interface {
                        1
                );

-               return ( $current_page - 1 ) * $context->get( 'events_per_page' );
+               return ( $current_page - 1 ) * (int)$context->get( 'events_per_page' );
        }
        /**

The logs were from a site running the-events-calendar 6.10.3