The reason of invalidation of these 2 issues in this very centralized protocol was: handleded-off-chain.
I think this an unacceptable excuse. They should have been valid, simply because, if you are monitoring all that off-chain why do you even need those checks on the smart contracts in the first place? You don't, it's useless flawed code.