Not having any limits on that invert setting is definitely a security/safety bug.

The password is a level of incompetence beyond what you'd call a bug. It's clearly following a design decision that was imposed by someone with zero security experience.