This is one of those things that I sorta knew in the back of my head seemed fishy but never fully grasped the security implications of. From 0xcc.io: