An undocumented change to a core system behavior that fundamentally altered how (likely) most applications behaved in an unanticipated (for the users of the system and programmers targeting the system) way. That's malpractice.

Yeah, I don't buy that. Too much Monday-morning quarterbacking.

I'm not against some well-thought-through standards for certain safety-critical applications, but it's got to be a lot better than "maybe code would be better if we threatened to throw engineers in jail for contributing to complex and subtle interdependent bugs that caused a privacy bug that didn't have a significant real-world impact".