You misunderstood, the main issue is that there's some user/pass auth code of unknown quality exposed, instead of basic auth done by some battle tested httpd im

You misunderstood, the main issue is that there's some user/pass auth code of unknown quality exposed, instead of basic auth done by some battle tested httpd implementation like apache/nginx. Which in ideal case, is also split from the application and can be independently updated if needed. That certainly does affect security posture.