There certainly are monsters such as ghouls that don't use their proficiency bonus on some of their attacks. (Ghouls are proficient with their claws but not their bites.) From a monster-math point of view, the DMG allows you to assign arbitrary to-hit bonuses to arbitrary attacks, as long as you account for it correctly in the CR. This is similar to how you're "allowed" to have an AC 30 CR 5 creature, as long as you trade off the strong defense with low HP and/or weak offense. But from a convention standpoint, nothing in the monster manual actually does that. Low-CR creatures tend to max out around AC 18 (hobgoblins) or perhaps a bit more than that for Derro.
Anyway, the point is that if you're the DM, there's actually no such thing as being "off." The monster stats are what you say they are. Even CR itself is subject to DM judgment: if the CR tables say something should be CR 5, and you think it's really CR 7 because of wonky abilities like petrification which the DMG doesn't do a good job of accounting for... the DMG tells you to trust your own judgment, not be a slave to the DMG tables.
As an aside, I have never yet seen a player complain about getting too much XP because the DM calculated the monster's CR "incorrectly" for its actual threat level.
Good gaming!