LISK wallet lets you send LSK without passphrase?

Just noticed this, is this normal???? Seems like garbage security. Not a FUD post but genuinely concerned about this - but maybe it's just me?