The bug
The tool final argument of the /loot command can be set to any string without causing a syntax error. It’s supposed to be either an item, or the literal strings mainhand or offhand.
How to reproduce
Run
/loot give @s loot "entities/pig" alksdjfklasjfaiejfioj
Expected result
Syntax error
Observed result
The command runs
can confirm