I would rephrase this as: an institution most important goal is self-preservation. It is a bit the same as how a specific implementation can have security bugs, while an algorithm in abstract does not.
There is a big difference: once a bug is found in an algorithm, it is removed. But in religions, once a problem is found, they will just threaten the people who found the problem and protect the perpetrators.
An exception being Microsoft, who is forced by the US government to keep bugs in their platforms :-)