I've applied the SUPEE-5994 Patch Bundle to Magento v220.127.116.11 this morning on a development system, and I'm still able to get to the 'hidden' admin login when calling a module directly.
- Compilation is off and cleared, caches flushed, etc.
- Admin is on [https] devhost.local/index.php/SECRETSTRING
- Accessing [http] devhost.local/index.php/MODULENAME/adminhtml_rule presents a login form on [https] devhost.local/index.php/MODULENAME/adminhtml_rule?SID=STRING
Am I misunderstanding either what the patch is meant to solve, is it an issue to pass to the developer of the affected modules or have I missed out something?