I agree with the change from a preventative/safety perspective, though I'm struggling to classify it as a security issue, given that collections are always named by the code and not from user input.
Am I missing something?
True - but not the case with the server-group.
It is a collection node, still has it's own label.