Is this a WordPress security bug?

You’re misinterpreting the is_admin() function. It’s not a tag to check whether or not the user is an admin, it’s a template tag to check if you’re on an admin page.

From the Codex:

This Conditional Tag checks if the Dashboard or the administration panel is being displayed. This is a boolean function, meaning it returns either TRUE or FALSE.

You’re facing a couple of issued here though.

1. If you attempt to go to /wp-admin while you’re not logged in, WordPress will automatically redirect the page. A request to /wp-admin is really a request to /wp-admin/index.php, a page non-logged-in users don’t have permission to see in the first place. So you’ll be redirected to /wp-admin/wp-login.php which doesn’t necessarily load your plugin code.
2. I say “doesn’t necessarily load your plugin code” because I’m not sure. From the looks of things you’re echo/return exists in the global scope. Really, this code should be wrapped in a function and hooked to a WordPress action.

Now, if you go to the /wp-admin page while you’re logged in, is_admin() will evaluate to true you should be able to see the content of your echo statement just fine, assuming a couple of things:

1. No errors in your code (as both @amit and @Fraggy have pointed out, you have a typo – an unescaped ' character.
2. That you’re hooking things in at the right place. You shouldn’t just echo and return in the global scope because, really, there’s no way to control where that echo/return will be happening. You should place this code in a function.

Important Note

If you ever do find a security hole or security-related bug in WordPress, you should report it to [email protected] rather than posting in a public forum like this. This kind of responsible disclosure gives the team the chance to address and patch the issue before malicious hackers can read about it and exploit it.