/deop command does not use UUID to remove players.

Apparently... the /deop command does not follow/check for removal of the entry for the player in ops.json by UUID. If you have multiple duplicate names in the ops.json file it will only just remove the first one it finds. This isnt a serious issue but it could be if you just happen to have a op that changes their name and then someone else takes it. as it will create two entries for the same name with different UUID's. This is also easily possible by a server going online and offline mode for testing as well... Main concern here is that the proper entry in the ops file is not removed.
Granted that this might be a rare thing indeed but it is still a security issue since you are only 'name matching' for the first match that shows up.