Your conspiracy theory is a bit too complicated. Here is how it works in practice: Bad actor shows up (compromised employee, or vendor with system access, whate

Your conspiracy theory is a bit too complicated. Here is how it works in practice: Bad actor shows up (compromised employee, or vendor with system access, whatever). Bad actor notices that code reviews are not required or a reviewer can be buffaloed with a 10k line commit, and static analysis tools aren't a commit hook, or employees don't lock their computers, or he has access to scp a binary on to a production server, or dozens of possible exploits that everyone knows about and is planing to fix eventually...