I do agree with you, but I think in this case it is a DotClear issue.The default themes provided with DotClear do not check that they have been called by a regular DotClear page, and spit out useful information for an attacker.
They should check that a certain variable is defined for example, and if not, do not display anything... even if the hosted website is configured to display errors, and you cannot change this.
Fatal error: Call to a member function fetch() on a non-object in /home/users/xxxx/dotclear/themes/xxx/list.php on line 34Note it's not wise to display errors on a production website. However, when hosted, you don't necessarily have this choice...