People seem to be under the impression that regulation inevitably means "someone has to review/audit every single change that was made to any aspect of a product". But in practice there can be all kinds of provisions, from the weak to the strong.

A weak provision may be that at least a minimum of development and testing has to take place, with requirements on record-keeping and naming of responsible persons: For a simple device, or a simple software, this might take the form of a checklist or a questionnaire which you have to take before uploading code to the App-Store.

Yes, this seems very straightforward to fake, but at least then you have deliberately cheated a system designed to catch errors, and not "just written shitty code" (or built a flimsy mechanical device... when applying this scheme to non-software world). Which, I think, would already help a lot to make people accountable for their products/inventions/...

{for, example: with CE certifications, you, as a producer only state that you have built your products according to some harmonized standards, but the conformance itself is not tested by a third party}

With increasing security/privacy requirements, the mandated measures can could then be ramped up. Maybe scaled by permissions of an application (accesses otherwise protected data?), the ability to process sensitive date or maybe number of users?

The extremes measure would be a full line-by-line review on every change, when software is life-sustaining or a fault may have catastrophic (death of people, like running a pacemaker or steering a huge plane).