Application Config rest.openApiSpec disabled: true doesnt seem to work

Describe the bug

Currently I set my config as this

const config = {
    rest: {
      port: +(process.env.PORT ?? 3000),
      host: process.env.HOST,
      // The `gracePeriodForClose` provides a graceful close for http/https
      // servers with keep-alive clients. The default value is `Infinity`
      // (don't force-close). If you want to immediately destroy all sockets
      // upon stop, set its value to `0`.
      // See https://www.npmjs.com/package/stoppable
      gracePeriodForClose: 5000, // 5 seconds
      openApiSpec: {
        // setServersFromRequest: process.env.NODE_ENV === 'development',
        disabled: true,
        // servers: [{url: 'https://mp.localhost/api'}],
      },
    },

endpoint to /api/explorer still accessible where it should not
https://loopback.io/doc/en/lb4/Customizing-how-openapi-spec-is-served.html

Logs

No response

Additional information

No response

Reproduction

https://codesandbox.io/s/nostalgic-taussig-qgxc52

Start with the REST application configuration shown in the issue and compare the documented rest.openApiSpec.disabled behavior with the /api/explorer endpoint. Reproduce the problem using the linked CodeSandbox and consult the linked OpenAPI serving documentation. Done means disabling the setting makes /api/explorer inaccessible as expected.