There is a proper roles system. But as a shortcut, roles are assigned by domain. It's either this or manually creating/accepting accounts if they need privilege

There is a proper roles system. But as a shortcut, roles are assigned by domain. It's either this or manually creating/accepting accounts if they need privileges other than the default. In this case, they could get away with the shortcut (if you exclude the MySQL misconfiguration), so that's what they have done.