Well, admins (or anybody other than the developers / deployment pipeline) having permissions to alter the JS sounds like a significant vulnerability. Maybe it wasn't in the early 2000s, but unencrypted HTTP was also normal then.
The account in question had "staff" rights which gave him basically all rights on all wikis.
It used to be all "admin" accounts, of which there were many more. Restricting it to "interface admin" only is a fairly recent change.
Its been 8 years!
It's a common feature of CMS'es and "tag management systems." Its presence is a massive PITA to developers even _besides_ the security, but PMs _love them_, in my experience.