If it had been developed as a feature of an existing application maybe it would fly (and probably even not there). But as a third party app, or even a third party library that needs to be added to the security supply chain? Not a chance for any serious business.
Why would you think "serious business" is the target audience? I think "serious business" is about as far from the target audience as possible...
"Does nobody make apps for fun anymore?"
Sidetrack but this is interesting wording, what do you mean exactly? As in some software that is accesory to other software? Or something that you have to access while moving between software?
(Also, for the record, since I’ve had people argue with or downvote me just for expounding on someone else’s point: this is not an endorsement of GP’s opinion, only an explanation.)
> “Does nobody make apps for fun anymore?"
The author isn’t making a fun app, they’re making an app for fun. Your crazy incident doesn’t really have much bearing on how much fun the author has writing an app.
Did PMs and other engineers review and OK this? -> Suggests a lack of judgement or just rubber-stamping.
Did a lone engineer add this "just to be cute", and it didn't get caught and stopped? -> Proof that your development/release processes are insufficient and you are intensely vulnerable to insider threats.
Neither is good for a security product. At a previous company we were explicitly told that any easter egg was an immediate firing. The company's products had a long history of easter eggs before that.