One thing I’ve noticed is that most of these issues don’t look obviously wrong.

The code “looks fine”, compiles, even passes basic tests.

That’s what makes this tricky — the risk is subtle, not obvious.