And now for the rest of the story...
The cylinder is actually a new-ish one, I put in a few years ago because the OEM was in bad condtion. The outer "wingnut" that you put the key into and turn with your hand was loose from the actual cylinder, so it was getting misaligned without the key in it.
I bought a new key cylinder but I didn't want a different key for the ignition and the doors, so I took it apart and put in the "tumblers" from the OEM key cylinder.
When the key is in and turn to the on position, it is locked into the cylinder. However, if you turn the key to the OFF-OFF position, it comes out, but the cylinder isn't necessarily "locked" into the off position. If you remove the key then you can turn it back on, but you can also turn it a bit further to make it lock.
So, you're probably right that something is worn enough that it is allowing this to happen. I SHOULD fix it, but it's one of those things that is easy to put on the back burner. Obviously a security and possibly safety issue, but that goes with the territory when you're talking about a 22 yr old car...