The spec should be robust against the possibility of implementation errors that result in the system being less secure. This is distinct from the possibility of

The spec should be robust against the possibility of implementation errors that result in the system being less secure. This is distinct from the possibility of implementation errors that simply result in the code not working at all or being obviously broken. You can't prevent those, but you also don't need to. The point is that subtle implementation errors should be ruled out as much as possible. This is a common criterion in cryptography, against which systems and primitives are judged.