Thanks for mentioning this! I saw it but never put much thoughts into it. Now it seems a huge security risk/active security exploit.

Strangely enough, I cannot reproduce this now.

I'll see when it happens again, and if I can uninstall keyboard via adb. It's just a pre-installed app, after all.

What do you mean you cannot reproduce it? Enable the setting in your Android to notify you whenever any app pasted from the keyboard.

Unless you have already used adb to disable or remove the app, the issue is guaranteed.