This validation is actually to stop other users being changed *to* the hidden auth source - we're checking for users who are now hidden, but aren't the known hidden users.  Try taking another user as your "u" and switching to the auth source and it'll fail to validate.  (There's a test for this.)

I could add validation for stopping hidden users being switched away, but I don't think it's as valuable.  I'm trying to stop users getting special privileges.