This is not security hole, but the custom code that you have shared.

// When you load global user object
global $user;
// And assign and user object to global $user object.
// Drupal basically change the context of current user.
// Its kind of hacky login by code.
// Hacky because, till this code executes.
// There is no log about the user login, untill drupal writes current session in database.
$user = user_load(<any_uid>);

This is no security hole, it's the custom code you shared.

// When you load the global user object ...
global $user;
// ... and then assign another user object to the global $user object ...
$user = user_load(<any_uid>);
// ... Drupal basically changes the context of the current user.
// It's kind of a hacky login by code.
// Hacky because, till this code executes
// there's no log about the user login, until drupal writes the current session into the database.

Typically $account is advised to prevent accidents like this.

$account = user_load(<any_uid>);

This is not security hole, but the custom code that you have shared.

// When you load global user object
global $user;
// And assign and user object to global $user object.
// Drupal basically change the context of current user.
// Its kind of hacky login by code.
$user = user_load(<any_uid>);

This is not security hole, but the custom code that you have shared.

// When you load global user object
global $user;
// And assign and user object to global $user object.
// Drupal basically change the context of current user.
// Its kind of hacky login by code.
// Hacky because, till this code executes.
// There is no log about the user login, untill drupal writes current session in database.
$user = user_load(<any_uid>);