I suppose the reuse wasn't accidental, but they mistakenly thought the key doesn't matter for CMAC.