The implication here is that the "change a 32 byte constant that nobody knows the provenance of to begin with" thing is what allowed this to fly under the radar

The implication here is that the "change a 32 byte constant that nobody knows the provenance of to begin with" thing is what allowed this to fly under the radar for 3 years compared to an "if (attacker) { give_root(); }"-style insertion.