This is no security issue rather than a privacy/spoofing issue. It was meant for delegation purposes but will be removed in the next version 1.5.
The user is still logged in the original user and so the security functions of other apps still work and are not affected.