Maybe this is not a security vulnerability, but a feature, intentionally put here as a backdoor. This would not be the first time such behaviours are observed.