this is not a pubkey but the script passed
So what? It is 2-of-15, which means only two keys needs to be valid. But in case of this particular Script, it could be 0-of-15 as well.
Another example of 0-of-1 multisig, which doesn't seem like it, when you first look at the Script:
https://mempool.space/address/37iy592iNBLTPyF4y2iyxpacHsbvV48ZyZSee? If you have "OP_1 OP_1 OP_CHECKMULTISIG", then you would think it is a 1-of-1 multisig with no keys. But this interpretation is wrong: it is anything-of-1 multisig, with the last public key being invalid, and set to "OP_1". And anyone can put "OP_0", and make it valid:
https://mempool.space/tx/7521d8bd0ffabd75de220d5b8f343e462076769498902784d17af5c9fa4015f4Edit:
But why?
Because someone wanted to make 2-of-3 multisig, and made anything-of-15 instead. Which can be easily seen, if you notice, where coins went:
OP_PUSHNUM_2
OP_PUSHBYTES_33 03416299921f66491349cf663df1da76e8aa7866f00c31578182a5ab7ca15a67a6
OP_PUSHBYTES_33 03157e46f7e48d3aa5440a478ddb2c040dcaa5ecf061e820cccbf8763eabb69763
OP_PUSHBYTES_33 02eb3b6b93f6dfdebea68febac071422a94a0fddf3727ebc50fe29906c14c25cb6
OP_PUSHNUM_3
OP_CHECKMULTISIG
See? Someone intended to use
bc1qyuvla6uqhdfs3w807aqzuuw0l8z4xrn4u98ecpqmueq5fv7463zsnw86wj, but by replacing OP_3 with OP_15, ended up with
bc1qac7ra58m8qjv5u30xs26wucdvnpwdzzap08yv8dpyllaj04nfv5q26eklz. Fortunately, it was moved by the rightful owner, which was not the case in some other
weak scripts, where someone probably intended to make an inscription, but forgot about OP_0 before OP_IF, and
it was moved without any signatures.
Presumably it must have been done on purpose as it would be rather difficult to guess the correct witness script.
Well, the owner was probably lucky. By knowing
this transaction, someone could replace OP_3 with OP_15, and steal these coins, by making 0-of-15 signature, or using some custom keys. Usually, coins like that are either unspendable, or spendable by anyone, but it seems the rightful owner acted before others noticed.
