Why are anonymous visitors logged in when they visit /user/[uid] page?
This is no security hole, it's the custom code you shared.

// When you load the global user object ...
global $user;
// ... and then assign another user object to the global $user object ...
$user = user_load(&lt;any_uid&gt;);
// ... Drupal basically changes the context of the current user.
// It's kind of a hacky login by code.
// Hacky because, till this code executes
// there's no log about the user login, until drupal writes the current session into the database.


Typically $account is advised to prevent accidents like this.

$account = user_load(&lt;any_uid&gt;);