Lately, I have been worried about some BIP getting merged that has an unforseen consequence. As someone that isn't able (yet! I'm learning) to audit changes, it seems like the weak spot.

Think of any company getting hacked. In general, someone was tricked into telling someone else the password. Social engineering. Bitcoin is strong, humans are the weakness.