SELECT * is shorter, survives a schema change, and does not need updating when somebody adds a column. Every one of those is true and every one of them is the problem: the next column somebody adds goes out over the wire, to whoever was already allowed to call this endpoint.
The handler here does nothing wrong with what it is given. It serialises the rows it got, which is what a handler is supposed to do. The defect is a hundred characters earlier.
GET /admin/usersBoth builds return the same users. Only one of them returns their password hashes.