Ok, elaborating on my earlier comment. I do not believe this is a security hole.

DataInterfaceDispatcher just has the export reports now, pulling the map from:
https://github.com/dimagi/commcare-hq/blob/settings-users-split/corehq/__init__.py#L91