Another thing that raised eyebrows is that the code to check for the “wp-” prefix specifically allows Automattic to use it, so there was an exception added for Automattic.