This one of main challenges in information security (and probably in IT in general) - code is completely invisible for a lay person and even for a professional

This one of main challenges in information security (and probably in IT in general) - code is completely invisible for a lay person and even for a professional it takes a lot of time to tell the difference between good and bad code. A hardware device, say a water pump made by industry leader would look very different from one made by a hobbyist in garage. It's obvious even to a lay person that a door from thick still is more break resistant than one from hardboard. But code written by a summer intern without any review and tests looks not much different from one written by seasoned professionals and carefully tested. Even if some software if full of RCE it takes a lot of time and motivation to find them. Huge amount of dependencies and many layers of abstractions make it even harder to see the software system as a whole.