Is anyone truly surprised by this?
The feature they're referring to is configured remotely [1] with a set of domain filters that demonstrate the intent was to only capture a subset of sites. I think this is where I'm now supposed to refer to Hanlon's razor--Never attribute to malice that which is adequately explained by stupidity.
[1] https://www.bingapis.com/api/v7/followweb/getdomainfilter?ap...
If microsoft really wanted to scan ALL urls that badly, they can... always just do exactly that? But when they actually implement fairly decent feature that has a bug in it... it's probably a bug yes. They really have no reason to be sneaky about it