We return 418 in a few places at work for endpoints that are only accessible to employees and you are not logged in. It’s a silly little Easter egg. Shame to see it going away.
Pretty sure you're supposed to return a 403 in any case. It'd be a nicer easter egg when sending some nonsensical but carefully chosen arguments to said endpoints.
Hmm, yeah, it's a 403 unless you are passing correct arguments but not logged in (which you'd only know if you were an employee or had access to the documentation).
https://www.rfc-editor.org/info/rfc9110