cakephp-thumber | cakephp-thumber is a CakePHP plugin to create thumbnails | Web Framework library

Well, you are not required to pass any defaults to a route, so from that point of view it's correct, the route wouldn't be "bound" to a controller. If your middleware wouldn't intercept the request, then things would end up with a MissingControllerException being thrown, as the dispatcher would get null as the controller name. The resulting error message would probably be a bit misleading, as there would be no controller name to include.

What you are doing there will cause your middleware to apply to all routes in the /thumb scope, so if there would ever be any other routes, then your middleware would require according parameter checks. You can restrict things further by applying the middleware to that one specific route, instead of the route builder: