This can be very dangerous, considering that someone could spoof a product, and make people buy a fake version of the product, while actually being on the real store domain.

For example, I created a product on my store:

And I can then just change the subdomain, and it will still work:

Fixing this is critical to prevent impersonation.