It appears that the bug is that the change address is always the last one, which defeats the purpose of having a change address. You can see that this is what their commit changed:

https://github.com/BitGo/BitGoJS/pull/12/files

A change address is designed to enhance anonymity on the blockchain (to anyone who says this doesn't exist, prove it and tell me which bitcoin transactions I've done). With a change address, whenever Alices makes a payment from address X, during a single transaction part of the money goes to Bob's bitcoin address Y and the rest of the money goes to another address Z under Alice's control. The idea is that people should not be able to tell whether Alice controls Y or Z, so it should make it more difficult to know exactly how much money Alice and Bob ended up with.

Of course, if you always know that Alice's change address Z is last, this whole exercise is futile.