I took a look this since I'm currently playing with the html/template package.
When checking the type of known attributes the html/template package removes "data-" prefixes so it can handle things like data-href or data-src as URLs or prevent unsafe values for fields like data-method. So data-data becomes only data (at least for the type checking). Since data is a known attribute used to specify the URLs for <object>'s the parser treats it, and thus data-data, as URL.
So I'd say this works as intended. But we should at least update the documentation to state that data-* attributes and attributes with namespaces are handled as if they had no data- prefix / namespace.