Comment by yogorenapan

And I remember that did happen at one point: https://github.com/acheong08/obi-sync

The mechanism that allowed that was patched as a vulnerability