He does. Early versions allowed you to spend anybody else's money by using this script as "signature". Spending money involves prepending the input script to t

He does. Early versions allowed you to spend anybody else's money by using this script as "signature". Spending money involves prepending the input script to the output script, then executing and checking the result. Normally the output script is something like "[pubkey] OP_CHECKSIG" (for the old P2PK), and the only input script to cause the combination to succeed would be the valid signature, such that "[sig] [pubkey] OP_CHECKSIG" succeeds. With "OP_TRUE OP_RETURN" instead of [sig] it would also succeed as OP_RETURN would stop execution. This was fixed by ensuring OP_RETURN stops execution AND fails the script.