

No, that is required for rm -rf /. But the command in question was rm -rf /*, note the asterisk. The * will be expanded by the shell, so what rm sees when it evaluates argv is not /, but [/bin /usr/ /lib ...].
You can test this yourself. Run: rm --recursive --interactive /. It will abort, saying:
rm: it is dangerous to operate recursively on ‘/’
rm: use --no-preserve-root to override this failsafe
Then, run set -x in your shell. That way your shell will print the command that is actually executed. Finally, run:
rm --recursive --interactive /*.
In my case, the output is:
$ rm --recursive --interactive /*
+ rm --recursive --interactive /bin /boot /dev /efi /etc /home /lib /lib64 /media /mnt /opt /proc /root /run /sbin /srv /sys /tmp /usr /var
rm: remove symbolic link '/bin'?
The line starting with a + is from the shell and shows which command was actually executed. After that, you can see rm will now happily start deleting files.









I would say it was at least co-authored by AI.