That's my point. "Security" is a complete package, that includes good QA.

It's a bit worrying that people noticed this 3 months ago, and there have been no fixes.

Yeah, that seems like a no-brainer to me. Even my company's small 2-person software 2-person QA team has a release test to make sure all debug parameters are shut off. The software won't even run if a debug parameter is on without some special shim that only us devs have.