I think there you hit the nail on the head! Just the fact that it is in there, whether intentionally or not is something that warrants warning people about. So that in the case someone goes to set up a server, they at least know that recently there was this rather severe risk of unnecessary credential exposure, again no matter if it was intentional or not.
However, I will say that I think I would have also opened the PR, not to help the original dev necessarily, but helping those that might come to use the software later.
Not my area of expertise but density is the wrong concept to be looking into remaining equal, its pressure. The amount of helium gas you pump in to the balloon creates a certain outward pressure that’s at equilibrium with outside air pressure, that’s why it doesn’t collapse (if you were to place the balloon in a vacuum then it would expand and probably burst, that’s usually what happens when a child loses one and it escapes higher up in the atmosphere to lower pressures)
The atmospheric pressure simply isn’t strong enough to overcome the outward pressure.
Bonus point: density is actually the reason why a helium balloon floats, its less dense than air so it wants to float up. Much like a rubber duck or ice cube in water.