What is the issue with the HTML Standard?

https://html.spec.whatwg.org/multipage/form-elements.html#attr-button-command-custom

Step 5.5 fires a command event with composed set to true, meaning it leaks in/out of shadow boundaries.

Given that commandFor can only point to elements in the same root, it seems like this feature is encapsulated within a root, but then the composed event crosses root boundaries, which seems odd.

For example, if, within a shadow root, I have a button which has a custom command pointing to another element in the shadow root, why should things outside that root get to see what the command is, and cancel them? This seems like a leak of my (the owner of the shadow root) implementation details.

cc @mfreed7 as you might know the background here.