Except testers and users aren’t programmers. Code reviews are what’s supposed to catch this stuff, but it’s rare for a team lead or other programmer to investigate every single commit.