Jenkins and plugins versions report

Environment
Jenkins: 2.452.2
OS: Linux - 6.5.0-1020-aws
Java: 17.0.11 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)

What Operating System are you using (both controller, and any agents involved in the problem)?

Linux - 6.5.0-1020-aws on kubernetes

Reproduction steps

We have some steps in our jenkins pipelines that use the credentials provided for the checkout for other git actions.
Therefor we use some credentials binding
withCredentials([usernamePassword( credentialsId: scm.userRemoteConfigs[0].credentialsId, usernameVariable: 'GIT_USERNAME', passwordVariable: 'GIT_PASSWORD' )])

This works with versions of these plugin previous to 887

Expected Results

scm.userRemoteConfigs[0].credentialsId returns the credentials id

Actual Results

Jenkins build breaks with:

{{09:34:41 java.lang.NullPointerException
09:34:41 at java.base/java.util.Objects.requireNonNull(Unknown Source)
09:34:41 at com.cloudbees.plugins.credentials.CredentialsProvider.findCredentialById(CredentialsProvider.java:897)
09:34:41 at com.cloudbees.plugins.credentials.CredentialsProvider.findCredentialById(CredentialsProvider.java:866)
09:34:41 at org.jenkinsci.plugins.credentialsbinding.MultiBinding.getCredentials(MultiBinding.java:195)
09:34:41 at org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding.bind(UsernamePasswordMultiBinding.java:73)
09:34:41 at org.jenkinsci.plugins.credentialsbinding.impl.BindingStep$Execution2.doStart(BindingStep.java:132)
09:34:41 at org.jenkinsci.plugins.workflow.steps.GeneralNonBlockingStepExecution.lambda$run$0(GeneralNonBlockingStepExecution.java:77)
09:34:41 at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
09:34:41 at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
09:34:41 at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
09:34:41 at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
09:34:41 at java.base/java.lang.Thread.run(Unknown Source)}}

Anything else?

I think this was very likely introduced by the security fix ad359b3

Is this a bug or is it the intended behaviour?