You can point to any product (such as Chrome or Android) and there are a huge number of serious bugs that have not been fixed for over 10 years.

In this case, it is a bug that will only affect people who make certain assumptions. One comment sums it up:

"This 'bug' fundamentally breaks basic assumptions about how AUTO_INCREMENT generally works"

I think there's your problem: making assumptions about how AUTO_INCREMENT works. The documentation doesn't say anywhere that it is guaranteed to never use a deleted key again.