At a certain level, you can't fix stupid (note: the person in my anecdote wasn't the stupid person). Example: once upon a time I worked for a very large public utility and got to be friends with a cool guy who seemed to live in the underground server rooms below Utility HQ. He would offer us (infosec group) 'free' hardware from time to time, which was cool (bear in mind CAPEX is a very good thing in the regulated utility industry, so there were all kinds of things kicking around taking up space).
At one point I was wandering around the halls underground, he spotted me, and said "Hey Mark, can you use this?" while pointing to a check printing machine loaded with valid corporate check paper. My jaw dropped. The first thing I did was look around for 'tells' of a corporate security sting. Dollar signs rolled in front of my eyes.
I asked said subterranean server room dweller if he had any idea what he had, and what he could do with it (I have no doubt one could easily make off with zillions of dollars and have it written off as billing errors). He smiled and said "no," to which I replied that was a good thing for our shareholders, and that he should probably properly dispose of that thing toot sweet. All the processes in the world and yet there was a literal money-printing machine hanging out with no oversight at all, prey to anyone with an RS-232 connection.
This, and laziness in the name of avoiding friction and remaining competitive. In every size organization I have been in the customer code will be audited by third parties. I have never seen internal automation audited by third parties. Not in banks or financial institutions. I've worked for both big banks and small financial institutions that grew into big ones. People get spread thin and fight to maintain control of the systems and code they are responsible for and this is only getting worse with time in my experience. With time more command and control systems are spread out and inter-connected with on-prem and cloud solutions that delegate root privs to third parties running entirely closed source code with very little consequences for damages. Infosec and security orgs apply very outdated logic that would not even stop an amateur attacker.
If you were able to do that, someone (probably multiple people) weren't doing their jobs.
By design these jobs do not exist at least not in a meaningful manor. People validate change tickets. People validate that code does what it says it does but that's where they usually stop. Security organizations these days are being moved under the same orgs that manage code to reduce friction. This stops Security Theater which is indeed a real problem but it also curtails people going down rabbit holes. Close ticket, move onto other issues, don't block a team from getting work done. Don't like what someone is trying to implement? No problem, design a better solution. For 8000+ developers? Yeah nobody scales like that.
People review individual code snippets. People stopped looking at big pictures of implementations. Disasters like Solar Winds don't happen because of one piece of nefarious code. They happen because a broken framework of thousands of pieces of poorly thought out code are glued together. There comes a point where the junk-yard of automation gets so big and ugly that even if leaders wanted to overhaul it they could not and if something nefarious was occurring nobody would see it, probably not even for a long time after damages were done. It's next to impossible to reverse engineer junk-yard automation which is what most automation becomes with time.
There is truth in this but what I am referring to is happening with principal and senior developers and orgs that would never touch excel. In fact Microsoft products are forbidden by contract in the production datacenters I have worked with in the last couple of decades.
It's hard to see nefarious behavior when it depends on thousands of pieces of automation and frameworks that are poorly glued together. It's even happening albeit slowly in my favorite operating system that has no shortage of incredibly intelligent and talented developers. Ironically these folks won't see it because they did not experience all the vulnerable frameworks and bandages that Windows implemented early on and now history is rhyming with udev + systemd + debugfs + binfmt + firewalld + ebpf glued together but that is a long topic in and of itself.
Another related topic could be vehicle automation and inter-connectivity. I am intrigued and curious to see how that one plays out.