The issue is where the undocumented commands are. They aren’t just allowing any old external person to send payloads to this.

It’s kind of like noticing that someone unexpectedly hid a spare key next to the door… On the inside of the house. Like, sure, maybe the owner would have like to know about that key, but since you have to be inside the house to get to it, it doesn’t really make a difference.