If a URL to an object contains an invalid PID (e.g. twu:twu:330), a 403 (Access Denied) error is returned instead of a 404 (Not Found) error. This can lead managers to think that there's a problem with their permissions instead of a problem with the URL.
If the URL points to a PID that does not exist, then a 404 is returned as expected.
Invalid PID (403 error): http://twu.arcabc.ca/islandora/object/twu:twu:330
Object doesn't exist (404 error): http://twu.arcabc.ca/islandora/object/twu:330333
Tested in production (7.x-1.9) and in Vagrant.