I took a close look at this. Between Unix Rogue versions 3 and 4, the developers added the behavior where a +4 to-hit bonus is given to an attack on something with the ISRUN flag not set. The ISRUN flag was originally set only for sleeping/held monsters, so the effect is that the player gets a bonus to hit sleeping monsters and the monsters get a bonus to hit the player all the time.
You're correct that the player's flags are initialized by default. This isn't actually a bug because the player's attributes are global variables, which are guaranteed to be set to 0 if not explicitly initialized. The Rogue devs used that fact a lot.
However, the player's ISRUN flag does get set to true in
one circumstance: when the player wakes up from some kind of sleep. I'm not sure why this is done. I suspect the devs were trying to reuse the ISRUN flag for whether the player is allowed to move, as part of a rewrite of the turn system that never happened. I verified that the flag does get set in Unix Rogue 5.4, and monsters did seem to hit the player less frequently. But the flag doesn't stay set for long. Several events, such as getting hungry, will unset it.
Monsters getting a bonus is probably not a bug. The Rogue devs extensively tested the game, and I doubt they accidentally made it substantially harder than they intended. I think setting the player's flag to true in some versions is a bug. There's no sensible reason why the player should be harder to hit after reading a scroll of sleep, but only until getting hungry. In fact, when Epyx made DOS Rogue 1.1, they deleted the line that sets the flag.
I probably will delete it from the versions I maintain too. Thanks for pointing this out.