This is no security hole, it's the custom code you shared.
// When you load the global user object ...
global $user;
// ... and then assign another user object to the global $user object ...
$user = user_load(<any_uid>);
// ... Drupal basically changes the context of the current user.
// It's kind of a hacky login by code.
// Hacky because, till this code executes
// there's no log about the user login, until drupal writes the current session into the database.
Typically $account is advised to prevent accidents like this.
$account = user_load(<any_uid>);
