Sure, but given a fixed probability of introducing a bug at each possible place, "doing an auth check correctly" has much less probability of being buggy than "

Sure, but given a fixed probability of introducing a bug at each possible place, "doing an auth check correctly" has much less probability of being buggy than "doing every memory allocation correctly" because it happens in several magnitudes less places.