I and l also look identical in many fonts. So you already have this problem in ascii. (To say nothing of all the non-printing characters!)

If your security relies on a person being able to tell the difference between two characters controlled by an attacker your security is bad.