> Presumably the governments who purchased systems from Crypto AG had people educated in security do some due diligence on Crypto AG's products before purchasing them.

Presumably they didn't. The article states "employees in the engineering and research departments repeatedly identified vulnerabilities in the products’ designs that they were mysteriously prevented from fixing", which implies that all it takes is for competent people to view the source code to expose the sort of fraud that was happening here.