Application Config rest.openApiSpec disabled: true doesnt seem to work

### Describe the bug

Currently I set my config as this

```
const config = {
rest: {
port: +(process.env.PORT ?? 3000),
host: process.env.HOST,
// The `gracePeriodForClose` provides a graceful close for http/https
// servers with keep-alive clients. The default value is `Infinity`
// (don't force-close). If you want to immediately destroy all sockets
// upon stop, set its value to `0`.
// See https://www.npmjs.com/package/stoppable
gracePeriodForClose: 5000, // 5 seconds
openApiSpec: {
// setServersFromRequest: process.env.NODE_ENV === 'development',
disabled: true,
// servers: [{url: 'https://mp.localhost/api'}],
},
},
```

endpoint to /api/explorer still accessible where it should not
https://loopback.io/doc/en/lb4/Customizing-how-openapi-spec-is-served.html

### Logs

_No response_

### Additional information

_No response_

### Reproduction

https://codesandbox.io/s/nostalgic-taussig-qgxc52

Start with the REST application configuration shown in the issue and compare the documented rest.openApiSpec.disabled behavior with the /api/explorer endpoint. Reproduce the problem using the linked CodeSandbox and consult the linked OpenAPI serving documentation. Done means disabling the setting makes /api/explorer inaccessible as expected.

Written by the indexing model from the issue text.