Agreement password protection anomoly

Hi,

Using the following API methods gives either the byte array of an agreement document, or an url to the same document:

GET /agreements/{agreementId}/combinedDocument
GET /agreements/{agreementId}/combinedDocument/url

The first method gets a document that is password protected with a password the user doesn't know.
The second method gets a document that is not password protected.

Does anyone agree that this is a bit strange (a bug)?

What's the point in method one if you can't open the document?

Any 'security' added by the password is rendered pointless by the existence of method 2 anyway.
Why make the API consumers jump through extra hoops to download a viewable document (via the url route)?

The documentation I followed never said anything about a password.

https://www.adobe.io/apis/documentcloud/sign/docs.html#!adobedocs/adobe-sign/master/api_usage/download_agreement.md

If this is considered a bug, how do we get it to the attention of someone who can get it fixed?

Many Thanks

Nick