I think the underlying problem is that lots of orgs have siloed out security stuff into its own workflow and its own class of bugs. It's basically Conway's law

I think the underlying problem is that lots of orgs have siloed out security stuff into its own workflow and its own class of bugs. It's basically Conway's law applied to the security/feature development split. So even if they have a build/release procedure with a mature regression test suite it probably wouldn't have "security" issues like this in it just as a matter of internal organization