My ironclad rule is that, if my attempt to bypass produce security succeeds, we bin it and run screaming because there will be a lot more that someone vaguely suitable could find.
It was sad, really. Whoever built that thin client OS had started with debian, so you could hear the muffled sobs of a system that didn't suck inside the mutilated husk. At least these days it's more likely to start with an awful android BSP. Result will still be alarming; but at least no decent OS died for it.