I agree with you entirely, but even then someone somewhere overruled those security auditors, right? And if this job was falling behind, they may have contract

I agree with you entirely, but even then someone somewhere overruled those security auditors, right? And if this job was falling behind, they may have contracted additional developers who came in to do work in a hurry, which can lead to an even worse and misaligned codebase, etc..