My thought exactly - this isn't an example of balance between "security vs usability" - this is just wrong behaviour.