Most malicious actors aren't determined, they're lazy and will take the path of least resistance. Code review will catch out those.