Yeah, when you have a pin named USB-OTP_VDD, you are asking for injection attacks. Imagine doing half the work for the attacker by conveniently separating the critical pin.
They really need to work on their power supply topology. Not only it will free up half the pin for I/O, it will also significantly reduce the attack surface.