The maintainer’s claim is that it was a small hobby project at the time. If their security record since gaining more users is acceptable, we probably shouldn’t rake them over the coals for leaving an unsafe debugging option turned on at an early stage.