As someone who has done red teaming of systems like this and found exactly that type of bug? Yes. Yes I do.

I'm sorry, but you are simply fundamentally misunderstanding how this works.