With everyone here pointing out that this is a really bad security practice, I don't understand why the response from the dev has been "not my problem, take it

With everyone here pointing out that this is a really bad security practice, I don't understand why the response from the dev has been "not my problem, take it up with the Matrix spec people". If a protocol didn't support something I wanted to do, I would simply not do it rather than implement it in a way that is wrong and also dangerous. If a protocol couldn't support something I wanted to do with it or the devs refused to add it, I'd simply use a different and likely better protocol (like XMPP) (also let's be real, the Matrix spec is already huge and has an even bigger, ever growing number of requested additions; I'm sure something like this has been sitting on their back burner for years). But actively making an insecure implementation of this, essentially doing the work of unintentionally making a phishing app and also normalizing it, making it more likely that people would unwittingly use a hostile actor's hosted version, is just weird to me. Ironically this does also serve as a proof of concept for how easy it is to pwn Matrix users