Twitter's API Bug unhide protected accounts

Here's the security issue: using a third party app like TwitterFox, which connects itself to Twitter through the APIs, it is possible to read each and every protected message that an unknown person have published inside his protected account. There's no protection and no filtering!