That technique from the code is known as ["ciphertext stealing"](https://en.wikipedia.org/wiki/Ciphertext_stealing). We usually use it with CBC, but your client seem to be using ECB.

So yes, it has the flaw of using the insecure ECB mode.