It was actually far worse for the Lorenz (Tunny) traffic. The wheel patterns - the equivalent of the key in, say, AES - were changed quite infrequently early on

It was actually far worse for the Lorenz (Tunny) traffic. The wheel patterns - the equivalent of the key in, say, AES - were changed quite infrequently early on. The five χ-wheels (in Bletchley parlance) were only changed monthly, while the five ψ-wheels were changed quarterly. While the two μ-wheel patterns were changed daily, there was little consideration given to what those patterns actually were. The χ-wheels generated the first of two sets of bit patterns to be XORed with the plain text; the ψ-wheels generated the second set. That would have been fine, except that the two μ-wheels together determined whether or not the ψ-wheels advanced - μ1 advanced on every keystroke along with the χ-wheels, μ2 would advance only if μ1 was a 1, and the ψ-wheels advanced only if μ2 was a 1 - and bad patterns on the ψ-wheels would mean that the ψ-wheels would be essentially frozen for extended runs of the message. What was meant to introduce a sort of dither to make it harder to determine how the key was being generated became the Achilles heel that highlighted the mechanism. (Not to take anything away from Bill Tutte and the rest of the crew at all. There was still a lot of cleverness and tedious attention to detail involved.) With a month of life on the χ patterns and three months on ψ, depths and near-depths on the message settings (the nonce or IV) were absolute killers. Later on, all of the wheel patterns were changed daily, and the μ-wheel patterns were verified for short stall lengths, but by then the machine's mechanism was well understood, pattern-derivation methods had been devised, and Colossus had largely eliminated the χ component from the puzzle.