Yeah, my first thought was that the plethora of tools the code has to go through — version control, whichever tools are used for code review, linters, formatter

Yeah, my first thought was that the plethora of tools the code has to go through — version control, whichever tools are used for code review, linters, formatters and tests — means the odds of getting anything like this into a big code base must be pretty low. Maybe if someone manages to combine this with impersonating a highly trusted person and that person doesn't find out soon enough. Or of course if there's no QA process in place at all, which is definitely the case at a lot of big companies.