Which makes sense, but as long as the tool itself pretends to provide security features, the fact that these features don't work is a big problem, as it may provide a false sense of security to end users.

It'd be better if they had absolutely no permission enforcement and delegated it entirely to another program, as you say.