PRODUCT_ID Unexpected behavior

I have set up a product in the organisations dashboard and assigned some devices - all is good.

However when I flash a different device (not associated with a product) with code containing the PRODUCT_ID and an old PRODUCT_VERSION the device is immediately and automatically flashed with the product code.

This should not happen as the device is not assigned to the product. Is this a bug?