Fa2.py update_operators permissions issue

[pravin-d]

objkt-swap/smart-py/fa2.py

Line 501 in 1d2ad69

sp.verify((upd.owner == sp.sender) |

The update_operators() endpoint - checks if the owner == sender for a given objkt_id or if the sender is an admin.
However I'm not able to see a check which actually checks the bigMap to see if the sender is actually owns the objkt.
Is it possible to call the contract endpoint (Fa2.update_operators()) directly using custom UI or Taquito and add oneself as the operator to any arbitrary objkt ?
If I'm missing something in terms of understanding the flow, please do let me know

[crzypatchwork]

usually a batch operation is sent with allow, transfer and revoke operator