I've seen similar setups to allow testing suites/local/lower environments to allow less restricted access. You have to be sufficiently careful how they work to prevent misconfiguring the real thing which may have happened here

Example: In production, a load balancer or other proxy handles authentication and passes a signed JWT to the application but running locally the application will take a JWT directly and signature verification is disabled. In this case, the application has multiple checks in place to make sure it's running locally and in production environments it has network policies to only allow traffic from the authentication infrastructure.