I believe its a result of chasing the speed and happy path. The intent was to make the data available for reuse on the backend side for the same user session, it kind of makes sense. Making it available across the models is most likely by design.

The flaw is that the data is not strictly tied to user session, making the session data hijacking a lot easier.

1. Its a security issue.

2. Publicly available sessions make it much worse