This seems to be the same problem as upstream issue 6632 (https://github.com/systemd/systemd/issues/6632), but upstream has not (yet) classified this as a security issue ...