Why can anyone change server CVARs?

[Player701]

I'm not sure if it is a bug, so I'd like to ask a question first, and this forum looks like the most appropriate place to do it.

I may be having memory issues, but I think I remember that server CVARs used to be read-only for all players except the arbitrator (usually the host, but if the hosting player quits the game, another player will get this role). But now I've suddenly noticed that any player can change the value of any server CVAR, be it a custom CVAR defined in CVARINFO, or a built-in gameplay option. Is this supposed to happen or is it a bug? If it's the former, does anyone know when and why this change was introduced?

Also, here is an excerpt from ZDoom Wiki on server CVARs:

This CVAR is shared by all players, and in network games, only select players can change it.

This doesn't make much sense because the wiki doesn't explain what kind of players are considered "select".

[Rachael]

That's a bug. Only the first player, or anyone they designate, should be able to change CVARs. Though, the actual security on that is rather lax.

[Player701]

OK, time for some bisecting...

[Rachael]

In your bisecting you'll discover another bug where no one at all can change server cvar's in a net game. So be aware of that, too. It'll be before this bug, obviously, but I don't know if it's the fix that introduced this bug.