“/wp-admin/customize.php” bypasses Hide Backend URL

Hi there,
I’ve noticed this is still an issue when setting a Hide Backend URL which makes it easy for attackers to bypass the custom URL.

To replicate simply add “/wp-admin/customize.php” to your site url while not logged in.