Neither did the people writing it, or merging it. Security isn't an obvious property of code or there would be no security bugs. You have to rely on heuristics, and in this case the heuristics were right.