Yeah or even more insidious when a new state looks like, and so is modeled as, just a special case of one of the original two. As a mentor said to me early in my career "every functioning business system is a state machine, but the only ones that are easy to work on are where they knew that from the beginning."
Most systems I've worked on end up with one of the "original" states being a catchall or misc type entity that could carry any number of other meanings depending on timing and context. A lot of legacy code work in my experience is actually a game of "find and name the states" when they're spread out across multiple systems, written at different times and with different understandings of the broader system, and with different methods to track and modify them.