Special casing your domains to be assumed "secure" is exactly how you build vulnerabilities directly into your software.

It's an inevitable result.

Developers aren't aware because they assume a security model where the special casing is disabled.