Is theme_pager() vulnerable to HTTP Parameter Pollution?
Simple answer: no, theme_pager() isn't vulnerable to this kind of attack.

The pager functions only use the page parameter and don't make use of any other. As far as Drupal core goes, that argument is used only in the context of a PDO-prepared database query, and so any effort at malicious manipulation of that page parameter will simply fail.

As with anything, careless use of theme_pager() outside of the proper API - e.g. using the associated preparatory functions manually without properly prepared database queries - can result in unwanted side-effects. But the function and its associates aren't inherently insecure, and from a core perspective are used safely.