Thank you for those details @hotnoob . I was able to replicate this and ensured that it was flagged with our technical team.
It’s important to note that this behavior of the draft orders is not a bug per-se, but more of a platform limitation. I completely understand how this functionality is not ideal though, and stressed that to our team on behalf of our merchants.
My technical team also noted that if you have reported this through Hackerone (I don’t have direct access to it myself) that our Security team will be alerted and the ticket/issue will be reviewed. I really appreciate your diligence in making sure this was reported to all appropriate channels and teams.