I've seen a few cases. (Not that they were justified, but that it was a very convenient way to program by someone at the time) The use case here being you full

I've seen a few cases. (Not that they were justified, but that it was a very convenient way to program by someone at the time) The use case here being you fully trust another developer to use the API properly, not realizing a user could also use the API. Now, code review with a security perspective is usually enough to stop intentionally adding it.