I'd argue that it is not a bug - it is a wrong assumption (that all URLs are http/https) based on limited experience. With a typical bug code works not as auth

I'd argue that it is not a bug - it is a wrong assumption (that all URLs are http/https) based on limited experience. With a typical bug code works not as author intended it to work. Numbers of such bugs can be reduced by testing and better tooling. But software development as an industry creates incentive to be overconfident and not to question own assumptions: developers who don't stop to read documentation/standards/gather information in anther way deliver more features in less time.