Yeah this caught me off guard too- this basically means anyone on this chat service could do anything they wanted OR the chatbot was granted excess privileges on commission. Either way - serious violation of principles of least privileges.
If you are in the room with the bot, you can issue commands.
They could have forgotten that you can also just add the bot to another room. Major face palm, but plausible.