> It was reviewed the next day by his boss.

Assuming Master is the "protected branch" and not kitchen sink, this sounds like - "we test only in production". Wouldn't or shouldn't reviews happen before merging to master?

I was going to downvote you, but then you made me think - everyone pushing to a shared branch is the most continuous form of continuous integration I suppose.

I worked this way for years before we moved into full branched code review. I would never go back however.

That said, you should still have at least some review and automated testing before your code gets in everyone else's way.

Likely, it was their coworker who saw the changes, then reported the incident to the manager, rather than some sort of manager picking through every commit type process.