I don't think this is a security flaw.

That's like saying it's a security flaw in the Chrome store that you could enable dev mode, copy the malware and run it that way.