Seriously, how stupid is someone to use SHA256("")
More likely to be a programming error. I recall suggesting a few years ago in this thread that something like (pseudoish code)
assert(key != 0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855) would have avoided this particular issue.