If I understand this correctly, this is quite a flaw in the design of the client. The message is shown in the client, but is simply the response of an essential

If I understand this correctly, this is quite a flaw in the design of the client. The message is shown in the client, but is simply the response of an essentially random server in the network. That response is displayed with full formatting in the client as if it were an error message by the client itself. I never used any of this, but it really doesn't look to me like it is unreasonable to assume that error messages like this are created by the client, not an untrusted server. Untrusted servers should not be able to inject content like this.