If it's hidden, undocumented, and allows a malicious person to make your device do things it shouldn't then, yes, it's a flaw.