APIFeatures can select password field

I implement fields selection of APIFeatures from Jonas course like this

I discover that I can select the field password like this: users?fields=password and it will return the passwords of all users

Note that I make select: false in password the user's schema

So I fix this bug like the image below in lines 8, and 9, or you can exclude it like this.query = this.query.select(select + '-password -__v');

So this is the best way or I miss up something in the course