pull down to refresh
That's a humble take, and you're right, if I was solo coding it's definitely something that could have slipped me by (not that I would ever code anything security related in C let alone put it into production).
But this was a company that sold a product... they should have had a lot more redundancies in place and eyes looking at this all the time..
I'm not saying it is a reason to let them off the hook. But, I am saying that in my past this could have been me. I have since learned to protect my own work better. And when I test a PR I always check this.
What I had not learned until now is to also game out every macro in a manual source review of software I depend upon. I used to skim build system and deps. This is clearly a dumb tactic; big fat learning point. Embarrassing even.
As a user of said software that has actually used it to protect his cold stash for a couple of years, and then again after a reroll... I am extremely disillusioned with my own reviewing capabilities and concurrently emboldened to spend even more time on review. Because all that would have saved me if it were still in use would have been gaming dice I reluctantly rolled while I felt it was something tinfoil.