When the paperwork is describing the system design from high level down to low-level to sufficient detail that an external auditor can use it to examine the sou

When the paperwork is describing the system design from high level down to low-level to sufficient detail that an external auditor can use it to examine the source then no, that is not true. The security/safety processes (as applicable) are examined at every level from system-design all the way down to implementation. Its not perfect, but its best practice we have for secure/safe product development.