I think it'd be fair for them to say "no, we can't send it to any address but your home address", but that their fallback is to say they'll send it to where you are and then to send it to your home address instead is itself a security hole (albeit a smaller one).