I'm a bit puzzled by the fact that the reputation (but not the badges) is shared between CrossValidated and meta.
StackOverflow has two different reputations for the parent and the meta website.
Is this by design or is it a bug?
This is by design. Up- and downvotes are usually used on meta to vote on proposals, and people could be scared to a) discuss an idea that could be controversial, in fear of losing rep, or b) downvoting an answer, because they think the "punishment" for the answerer is too harsh. So the rep you see on a site meta is always the rep of the parent site.
By the time this was implemented, the main Stack Exchange Meta was already too large, with such a distinct community, that it would be a big change to "reset" everyone's rep score to the main SO rep (and some people deliberately don't associate their SO and MSO accounts). So they were "grandfathered in" as a standalone site.