Another possibility: someone was doing testing (and at thr stage too lazy), they made it public, and forgot about it even after they implemented authorization a

Another possibility: someone was doing testing (and at thr stage too lazy), they made it public, and forgot about it even after they implemented authorization at the application level. Could have used trusted advisor...