I dont think its fair to say a code review would have fixed this -- its an operational bug. They failed to initialise the library (ie: assigning ownership) after deploying it.

Last time the smart contract let anyone initialise it (which was a code problem).

Either way its pretty much the end of Parity. I bet those PolkaDot investors are going to be mad when their tokens are worthless!