It amazes me that such a big flaw went unnoticed for such a long time. At least I couldn't find any other post mentioning this. Thanks for verifying it on your side!

I am sending the notification from my local server, meaning I send it to the api.sandbox.push.apple.com:443 from a PHP server running on my local machine. I did not test it on an actual device because the server is not online yet and, therefore, I cannot get the device token. But from what I found out, the method should be called in the simulator, at least with the app in the foreground.