Currently, when a dispenser uses command blocks with nbt data, it ignores the nbt data when it places them. This should be fixed.

Actually this should be changed to ensure it can't happen. Dispensers were able to place command blocks since 1.8.0, but the feature was removed in 1.8.6 for security reasons (see MC-80671 (comment) for an official comment).

Command Blocks could be blacklisted from DispenserBlockPlacement by default(also structure blocks and structure void since they also cant be used in survival) so that you can use them with a datapack for map making.