This would be the system working as designed and not a bug. Many credit cards have subscription features that allow subscriptions to be authorized, even if the card is expired because a previous transaction took place. It is up to the card issuer to decline or not the card and therefore, this is a perfectly acceptable transaction. Additionally, what you're seeing there in the screenshot, would not be known to us with payment gateways as all we have is a transactional ID to attempt payment and the actual gateway holds the credit card details.
The user would need to manage their card if they do not want the card attempted.