It's by design. OTP backends are associated with users. Originally the backend database entries are used to store secrets as well. In our case, they're just dummy entries that are necessary for django-otp to 'see' the backends.

I was mailing Peter (do I recall correctly?) about it, and it seemed to be easier to create those dummy database entries than to rework whole django-otp not to require them.