Some more:

The worst are when you run into code that’s been around for a long time, but obviously doesn’t work, but which have stuff built on top of it relying on it not to work.

When two bugs manifest together in one symptom, the engineering approach that you have learned about breaking a problem down and testing one thing at a time, might not be enough to find the issues.

All projects are chaos, learn to accept that and to navigate it.

Centralising things into common classes, methods, functions, libraries, modules or services, for reusability, and for less redundancy, also increases risk, as it is now even more important that that stuff works.