In this particular example, the engineer and designer had very little incentive to make it bulletproof (as there was no check), and there was no guarantee that

In this particular example, the engineer and designer had very little incentive to make it bulletproof (as there was no check), and there was no guarantee that the decision taken were not wrong (ex. not complying to Security Standard XYZ.NNN) There was no "stakeholder" feedback as there is seldom an owner for these kind of decisions. If PM is the 'stakeholder' then these folks would have asked her "why are you not defining this?"