It is not a security hole per se, but the actual behavior of chanspy. You can also hop on calls, etc. The next fop2 release will have the option to pass parameters to chanspy, so you can previously set spygroup for particular extensions and limit the scope to just that group. Or use the e() option for Asterisk 1.6 to enforce channel names.
