The database could be corrupted somehow and then any password will match. Some developer may just look at the RFC and assume random strings should fail the chec

The database could be corrupted somehow and then any password will match. Some developer may just look at the RFC and assume random strings should fail the check, so may develop something that actually passes on random string. It’s probably not even a real security issue, but definitely strange behavior