Stealing passwords from infosec Mastodon – without bypassing CSP

Does this indicate the the infosec fork of Mastodon was less secure than the core?