If it produces results, does it matter whether you call it "engineering" or "hacking"?

It depends on the result. If the result is public embarrassment of the company and the loss of millions in market worth? If the result is someone dying?

Do you have any actual evidence that a culture of design documents and signoffs produces code with fewer vulnerabilities?

How to make flawless software that goes into space => A truckload of process and design documents. https://www.fastcompany.com/28121/they-write-right-stuff

Whatever software is made, the [lack of] efforts put in design and reviews will have high impact on quality [or lack thereof].