"Hidden" might refer to the fact that people won't know that the setting creates a (now) version-specific, persistent UUID that potentially compromises web safety.
Yes, and even the article doesn't say it was hidden. It has been just a feature that wasn't thoroughly thought when created, had a very bad side-effect, but it wasn't hidden.
The fact that it injected something wasn't hidden. The fact that it injected a unique ID wasn't documented, thus could be considered hidden.