Yes, and also MCP does literally nothing to prevent these sorts of exploits.
Like I said, AI bros vibecoding slop because they literally have no clue what they're doing.