SlowMist has caught another onlyOwner vulnerability; even if the owner becomes 0, it can still be exploited. How did this contract pass the audit?

SlowMist states that the ONTR token contract has an onlyOwner vulnerability, allowing an attacker to gain ownership when owner is address(0), transfer ownership, and inflate balances to 1e30 units through operations like desertJasper, glenFlash, ashBud without increasing totalSupply, resulting in a loss of approximately 49.4801 WETH (about $98k). Then, they exchange on PancakePair for WETH, involving addresses such as 0xe806...b760.