I always assumed it was the assumption that the user would be "remembered" by their auth token and that the user would be returning from an already auth'd devic

I always assumed it was the assumption that the user would be "remembered" by their auth token and that the user would be returning from an already auth'd device. When your UI team is testing user flows, if they're not starting from a fresh/clean session, they can fall into that pattern and forget to walk the "existing user, no auth" path. At a past employer we ran into that with regards to an Apple/Safari issue. It's been a while, but iirc it was something to do with scroll heights, modals, and a render engine update in Safari maybe 3-4 years ago. Nobody caught it during testing due to us using manual testing in a variety of browsers, and it was live for almost 3 weeks. It was annoying at normal use, but if you had fonts increased (i.e. eldery/vision impaired user) it meant the user would be unable to login. After that incident we switched to a hosted browser testing solution (I think it was BrowserStack, but might have been something else) and we made sure to flush things and test on multiple browsers per platform. I don't remember the full list anymore but it was something like 20 different browser/platform/version tests each.