I'm more appaled that it's that easy to write a backdoor like that
When Gmod loads up addons, it should do some kind of scan in LUA files for certain blocks of code that use various commands like 'adduser', 'debugPlayer:Name()', and '"superadmin"'
except for the fact that adduser and superadmin are both ULX which is an addon.
and debugplayer:name() is just a created function by the author of the backdoor and you can't block functions because gmod kind of needs them to work.
blame the ULX author, not garry, he aint got stuff to fix.
oh and not only that: people actually use that for debug purposes sometimes if they need to constantly wipe the database.