This was apparently by design: "We considered this scenario but the problem in some scenarios users could be having very specific route templates to their actions in the base controller in which case inheriting this to the sub class is incorrect."
The framework has functionality to deal with this already. Declare the base class with said "very specific route templates" sealed for starters. In my opinion this is intentionally violating LSP if one considers a route part of the public interface,
which is always the case for a web api.
A compromise could be reached easily by also testing if the base class is concrete.
// Ignore the Route attributes from inherited actions.
if (action.MethodInfo != null &&
action.MethodInfo.DeclaringType != controller.ControllerType &&
factories = null;
Or something similar.
This would in general be a non-breaking change as one would not have added routes to an abstract base class without intending them to be inherited.