WHM/cPanel reseller account security issue

In WHM/cPanel if a user and reseller have the same password, then when the user logs in they will have the same privileges of the reseller and access to all the other accounts the reseller controls. This behavior is known by cPanel and undocumented, with as far as I can tell no plan to fix it. It can be mitigated by updating the "tweak" settings to stop resellers being able to login to their cPanel accounts automatically from their main account.

Obviously password reuse is bad practice, but it's not difficult to imagine a reseller setting up a number of accounts might set them to the same password initially.

The issue is not visible you login to the cPanel account via a link in the cPanel or administrator's WHM account, only if you log in properly with the cPanel users username and password.

Is it just me, or does this seem outrageous?