Btw, a lot of hive engine tokens and games require only the posting key for transfering assets

Good point!
They should probably change the code as that is the entire point of the active key.
But yeah it's little things like that can lead to a big problem down the road.