Anecdotally I've seen smart and capable developers make this mistake numerous times. It usually gets caught by code review, automation etc. But not always. It'

Anecdotally I've seen smart and capable developers make this mistake numerous times. It usually gets caught by code review, automation etc. But not always. It's basically the birthday paradox. You take the probability of a very unlikely event and raise it to a big enough power (enough people, enough lines of code) it becomes a non-negligible outcome.