How is that a smoking gun indicating malice?
That check lies somewhere along the line between "having the direct goal of breaking authentication flow (pure malice)" and "is a completely legitimate programming error (pure incompetence)."
I am not ready to assume pure incompetence (and here's where I might be wrong).