I would not consider something so confusing to the end user to be a security feature. This is a bug, or you could use the label "broken".