I've been at many startups during a fundraising round, and I don't think I've ever seen or heard of an investor auditing the codebase.

I’ve been apart of many code audits as part of acquisitions and fundraising rounds on both sides.

I don’t know how prevalent it is but I’ve done it enough times that I don’t bat an eye when it comes up.

I offer this as a service. Typically when there’s a big acquisition and an audit of the codebase is needed, I gather up a group of developers each paid about $250/hr to go through the codebase and conduct audits looking for any red flags and giving an estimation of existing technical debt.

This sounds both really painful and really fun.

Is there a line item for "this code feels like there's something wrong, but I can't tell what" ?

When I did code dilligence, I just add it to a list of possible risks... or areas we'd like deeper investigation. Usually go back over it in follow up.

Neither have I but read some stuff about Tesla devs checking out the Twitter codebase or something? It’s ridiculous but that’s the only data point known to me

That wasn't due diligence (which he'd waived) but a census of what he'd bought after the fact. They weren't validating the purchase, but helping him plan what to do with it.

Says a lot about the software industry as a whole.

The best liars believe their own lies. Having said that, it's evident that SBF was very well connected and the "old boys club" doesn't ask each other questions; "that would be rude, you know." That's probably how he raised so much money in the first place.