Probably 'bug' is not the best word, but many programmers definitely consider excessive complexity as 'bad design' (unless complexity is inherently unavoidable due to the very nature of the problem).
User friendliness and security are not the parts that are bad. "Piling them on" is the part that's bad. UX and security need to be considered from day one.