The question to me is not what was written in policy, rather what was normal in the engineering culture at that company. They say they have a process for this,

The question to me is not what was written in policy, rather what was normal in the engineering culture at that company. They say they have a process for this, but how many engineers were following this process? How many fixes were deployed as EBFs before? How common was it to use EBFs with existing tried-and-true scripts? How clear is it in this manual process what you're doing? How much pressure was there to do an EBF? Depending on the surrounding culture around this, which I can't know from outside, he could be anything from a scapegoat to a cowboy coder. If you fire scapegoats you don't fix the issue.