This is absolutely a bug, and almost certainly a security bug. If you consider pastejacking the clipboard within the threat model that you want to account for, selection-jacking like this is absolutely within it, as it's a superset in terms of bad behavior.
(… but browsers have long maligned the primary selection on Linux. Neither Firefox nor Chrome have behaved properly for a long time, so it's not really surprising that they don't wanna when it comes to this bug. The primary selection is incredibly useful, but unique to Linux and even there, poorly understood amongst its userbase due to being a bit tricky to discover.)