They could be. If they have some OO Set of substrings that they check a composite login credentials string for then it is possible to accidentally have state t

They could be. If they have some OO Set of substrings that they check a composite login credentials string for then it is possible to accidentally have state that depends on the order of Set iteration. Quite a few systems use the "bung all options into one configuration string, then have it parsed by this argument parser" method. And it is a reasonable method to use.