the only issue is what it means to "fail". it's not really an issue until you're hacked and then it's too late

to fail doesn't mean to fail in production

right, but how else are you going to know your crypto is broken? what unit test is going to fail?

if you need expert opinion on your library order a security audit. otherwise even expert-designed systems have failed and most people know that it is very unwise to give security guarantees to devices that have so many moving parts