Move away TODAY, it's easy and saves money
There are other problems with 123reg as regularly featured on The Register, but in regard to the bare .uk names...
Firstly, having moved my .co.uk names away from and finding 123reg had reserved the bare .uk variants for me I had difficulty moving those bare .uk names I wanted to keep to other registrars. Some went OK but others repeatedly errored when I tried to change the IPS TAG. (I managed it in the end by using a different route.)
Secondly, I look after hundreds of names for other people, a few of those have moved their .co.uk elsewhere. I use my email as the contact address (that was because, before the WhoIs service was closed down, the contact address would be public and would attract scams and spam which would have tricked some of my clients into "inappropriate" actions). When 123reg registered the corresponding bare .uk they just cloned all the owner details. That means that, when 123reg send emails concerning the status of the bare .uk names for which I no longer manage the corresponding .co.uk variant, they come to me. I don't feel any obligation to a former customer who has chosen to stop doing business with me, those emails go into trash. Those names will lapse and will return to the open market.
Third. What the registrars like 123reg have done by registering the bare .uk names is increase their value to extortionists, see https://www.theregister.co.uk/2019/11/22/nominet_dispute_resolution_dot_uk_company_domains/. If the offer to renew the name in subsequent years is not taken up then the name will be allowed to lapse. My understanding of what happens next is that there are systems set up to catch names as they lapse and the valuable ones auctioned off. If a bare .uk name had never been registered it would never get onto those lists and would never come to the attention of those potential buyers.
Finally I have found that most business owners simply don't understand the issue "I've got joes-antiques-emporium.co.uk, why should I buy joes-antiques-emporium.uk?". There's no simple one-size-fits-all answer. I make an effort to explain the pros and cons to my clients. I want them to make an educated decision. Nominet and most registrars have a vested interest (£) in flogging the variant, needed or not. My advice to Joe would be to point out that the risks in respect of that name are far less than for names fitting my criteria for a valuable name: short, meaningful, single dictionary word or proper noun, no hyphens. It's only £6 a year inc VAT (or £12 at 123reg) but for a zero ROI and it's hard to believe a third party would find joes-antiques-emporium.uk attractive, most likely an extortionist. In the other hand if Tesco were my client (they're not!) I'd want to be sure they did secure tesco.uk
I moved all my names away from 123reg (many to purely.domains for half what 123reg charge for uk name renewals but the purely.domains control panel is a bit limited so I use it for names with simple requirements, for most others I pay a bit more and use LCN).
Do move, with hundreds of names it was a big job for me so I just spent a few hours each month shifting those due to renew the following month but saved over £1000 of my annual total renewals bills as a result. BUT make sure you don't just move to another part of the GoDaddy empire which owns 123reg. The hard part is that GoDaddy are in the business of acquiring smaller providers so your chosen provider might get gobbled up next week, next year...
I flagged all remaining names at 123reg as not to renew and deleted my payment mechanisms. I still hear from them every month when they invoice me £0 for the free backup service they provided in connection with a hosting service, seconds later I get "We have successfully received payment for invoice #..." so, yes I suspect their customer billing system is "flawed"!
Strictly that invoice now comes from a different part of the same group, TSOhost, as the result of a long history of mergers and re-organisations. (My understanding of the history is imperfect but something like: I leased a server from a provider that got gobbled up by WebFusion which in turn got bought by 123reg, when the parent group holding 123reg acquired TSO they migrated the hosted servers to TSO).