I wouldn’t even call this a vulnerability. It’s just a partially finished (known to be naive implementation).
We’re not doing ourselves favors by expecting fully mature software at this stage.
I appreciate the poking and the experimentation but the way it’s done just feels likes it’s in bad faith rather than collaborative or helpful.