This seems like a bug, even a security relevant one? The article doesn't talk about it, but I probably would have at least tried to report this to Google - may

This seems like a bug, even a security relevant one? The article doesn't talk about it, but I probably would have at least tried to report this to Google - maybe the Author did as such and just didn't write about it.