https://www.w3.org/WAI/WCAG21/quickref/?versions=2.0#qr-medi...
Failure F8 seems relevant to the loophole: https://www.w3.org/WAI/WCAG21/Techniques/failures/F8.html