It is in fact a 2016-era good security practice.

And it is designed to prevent what your last sentence says.