Routes pointing to Http4xxController are malformed

This is difficult to update for 11.x. We now have ControllerResolver::getControllerFromDefinition instead of ::createController, and this offloads the work to CallableResolver::getCallableFromDefinition. I had a look at adding the logic exceptions to callable resolver, but we'd also have to inject the container. By the time we do the validation to see if it looks like a service but is actually a class, and vice versa, that's repeating a bunch of lookups that ClassResolver already does. It would possibly make more sense to add an extra param to ClassResolver::getInstanceFromDefinition to only return a service or only return a class. Then we could update CallableResolver to validate with that param. That is still expanding the scope of this beyond ControllerResolver, so perhaps the param needs to be set all the way back there.

Or perhaps it doesn't matter and we should just allow this? We can "fix" the existing routes and carry on.

Do we know why there's no actual error here? Is it finding the class/method despite the wrong entry? Or are these ignored by the 404/403 handling and the route definitions are dead code?

The single colon is correct syntax for a method on a service. ClassResolver finds either a service or a class and returns an instance of the class. Then we check if the method exists on the class. So it's not dead code, it just "accidentally" works.