The bug
Burning arrows can light candles and cakes with candles outside the world border. This is inconsistent with the behavior of campfire blocks (campfire or soul campfire), which can't be lit outside the world border.
Code analysis
Code analysis by @unknown can be found in MC-223824.
Linked issues
relates to 9
MC-265989
Splash water bottle can extinguish the fire, soul fire, campfire, soul campfire, candle or cake with candle outside the world border
Resolved
MC-223824
You can ignite candles by using flaming projectiles in spawn protection
Open
MC-54119
Can place/take water/lava/lily pads outside world border and inside spawn protection
Resolved
MC-53602
Projectiles don't collide with the world border
Resolved
MC-54606
Explosions can damage blocks and set fire outside of world border
Resolved
4 more links
This has the same root cause as MC-223824: unlike the campfire block, the
AbstractCandleBlockclass does not check if the projectile may interact with the hit block. The fix provided by @unknown in that ticket also fixes this issue.