perhaps because the old API is still there? This appears to be a new less secure duplicate, with seemingly no benefit.
Also Apple took a lot of heat from the FBI case, perhaps this was part of the deal for them to drop the suit, which isn't a blatant back door.
The proof will be in their response to the issue.
Because people have faith in other people not being complete dullards.
That doesn't work either because Apple would have to be complete dullards to not realize that someone would found this obvious flaw within a week of the release of the OS. Especially right after launching a bug bounty.