Thats expected as you have equal cost multipath (ecmp) - in this case meaning you have two different paths to the same destination that have the same metric calculation so they are equal - when you iniciate say two or more separate traceroutes it is then being shared between those two ...
The rule says a router will not accept a route if the RD>FD meaning if my neighbors Reported distance is higher than my feasible distance then i will not accept the route and that should be the case when we are learning the route from a different path or longer path for the same prefi...
This is simply security-thru-obscurity, meaning that if someone ever gets a copy of your config somehow, all the "security" is gone. That's why I firmly believe that is important to identify your DMVPN peers by IP addresses for example. That would put another barrier for an adversary...