As far as I know, using a composite modulus is bad. It means that some of the integers (besides the obvious case of 0) no longer exhibit the group properties. That said, it only makes it a bit more difficult to find a generator. I am not sure about the overall security implications.

However, the plan here is too get someone to use your chosen modulus which is weaker. I'd suppose they are banking on no one checking that the modulus actually is prime.