I have not tested this, and gcc gave no warnings about it, but just by visual code inspection I do agree with you that this looks like a problem, even in the latest code.
IIUC for the case ALTER_SUBSCRIPTION_DROP_PUBLICATION it looks like the uninitialized copy_data local stack var would remain uninitialized (undefined) still at the time it is passed at AlterSubscription_refresh(sub, copy_data);