On the “ActionBindings” tab of the Developer Console window, the security column displays the opposite binding security.
Here’s an in-game screenshot illustrating this issue:
As you can see, bindings made by the core scripts (like F9 menu toggle and the Escape Menu) are all labeled as “Developer” while my own custom bindings are labeled as “Core”.