Not exactly what you describe but related: people build intentionally-vulnerable applications for the sake of teaching security by example.

In the sub-domain of web security, django.nV is such a "purposefully vulnerable Django application" that comes as companion to a websec tutorial: https://github.com/nVisium/django.nV

No disclaimer, I have no affiliation with the project, I just enjoy their work.