I'm no expert but using an old wallet with a changed password, and it working, seems like a major security design flaw.

In the physical world, I can't imagine too many people being happy that old keys to your house still work even after you've changed the locks.

Can someone more informed, help me understand how this worked and why it's ok.

I'm genuinely wanting to become more informed & better understand.

A wallet is just private keys of some specific public keys on the blockchain that have unspent output (UTXO). None of what’s described in this article involves the blockchain, only the storage and protection of the private keys on a local computer.

You can imagine that in your example, you didn’t change the locks on a house, but rather you put the house keys in a secure lock box and you changed the locks on this box.

Changing the locks on a house in this case means transferring from an old wallet to a new wallet and then abandoning the old wallet. That’s exactly what the OP is trying to do. It’s just that you need the original key to do it.

They didn't lose the key, they just didn't know which one is the correct one, where the lock is, and how the unlocking is done.

The wallet is akin to a lockbox holding your keys to the house. Breaking into the lockbox and changing it's lock does not affect the keys kept inside.