this isn't that much of a bug as a limitation of the implementation.
once an action is saved, we have no way of finding out who did that (and even then, who made which particular changes...)

there are lots of other scenarios involving application conditions that have similar effects.

no idea what to do about it

Messages are covered by users or rather user groups.
For commands I could imagine to enforce having at least one host group set as action condition - except for users with Zabbix-Super-Admin role.