No doubt, that's bad design. However, if you try-catch the code and return a custom error message, many frameworks would return a 200 by default if you don't explicitly set the status code.