I don't think this is something with malicious intentions. Those folks worked on this feature probably didn't want deal with all the mess on cross-organization

I don't think this is something with malicious intentions. Those folks worked on this feature probably didn't want deal with all the mess on cross-organization stuff whenever they need to support new sites/networks. They probably told the Edge team something like "This is a super high priority project from the SVP, just give me the ownership of this piece of code". Instead of implementing a proper client side domain filtering. Which is a worse problem ingrained in the org structure IMHO. Looks like they have no security/privacy process for this level of feature launches?