Developer-created binds from the ContextActionService are listed as Core, while those created by CoreScripts are listed as Developer. Normally, you’d expect it to be the other way around if you take the definitions of the security labels literally. Needless to say, CoreScript bindings still cannot be overridden or unbound by developer scripts. The only issue is that the security labels are reversed.
This seems to happen every time I bind an action via ContextActionService. To reproduce, just bind any action from ContextActionService (specifically AtPriority, unless other actions show up here as well) and check the ActionBindings tab for your binding.
This bug is not specific to any game, it happens everywhere. I can’t really provide a reasonable timeline for when I believe this may have started since I never look at the ActionBindings tab, but today was different I guess. I don’t really think knowing the time is relevant either.