The problem seems to be limited to the default language but it's possible to make requests to the system where the requested URI does match the requested language.

Consider a site with two languages, english and german. For example there is a hierarchy that looks like this:

• home (heim)
  • section (sektion)
    • content (inhalt)

A proper request for the german content would be:
http://localhost:8080/dx-core-webapp/de/sektion/inhalt

However, I am also able to access the german content with the default URL:
http://localhost:8080/dx-core-webapp/de/section/content

While both URLs technically make sense it's bad for SEO. The URLTransFilter needs to block the default URL and return a 404. Or at least have a toggle to block the default access.

Notes
It makes sense that the system would respond correctly to a URL with an explicit lang code and a default URI. For example:

• https://demopublic.magnolia-cms.com/about
• https://demopublic.magnolia-cms.com/de/about

The point is with URL translation we are overriding the page nodes names with translations which should be unique.