Cookies by default set at
www.example.com are considered different from just example.com
Sites written to accept both are somewhat out-of-the-norm in general coding practices and terms.
vBulletin is only following normal security precautions in its behaviour as you describe, however if the documentation says it should then do as Marco says and start a new bug for it.