When the YYZ T1 hermaphrodite gates are collecting US PAX the inbound US PAX mix with DOM->!DOM connecting PAX. This is relatively unsterile, but TSA is probably as good (which is to say, as useless) as CATSA.

An US->INTL PAX could easily, if fraudulently, transit that path without either customs or security controls, e.g. with an easily constructed electronic BP screenshot.

There is easily enough room in that hallway to keep the PAX separate, with a relatively cheap glass wall (and less cheap additional moving sidewalks), though it would require "crossing guards" (that actually do their jobs) at the level-crossing over at the root of the US/INTL pier.