How do you validate a strategic AI? You can’t trust it to be superior over humans because it beats humans in your simulator because, as you say, it may exploit bugs no one even knew existed, and some of those may not get recognized as bugs. https://en.wikipedia.org/wiki/Military_simulation#Problems_o...:

One notorious example was the US Air Force's Advanced Penetration Model, which due to a programming error made US bombers invulnerable to enemy air defences by inadvertently altering their latitude or longitude when checking their location for a missile impact. This had the effect of 'teleporting' the bomber, at the instant of impact, hundreds or even thousands of miles away, causing the missile to miss. Furthermore, this error went unnoticed for a number of years. Other unrealistic models have had battleships consistently steaming at seventy knots (twice their top speed), an entire tank army halted by a border police detachment, and attrition levels 50% higher than the numbers each force began with.

If you can’t validate it, do you dare trust it above humans?

With tactics, validation still is hard, but you can do (expensive) real-life experiments.