Hanlon's razor is just the worst. Systematic incompetence is malice.

Here's my alternative but equally reasonable platitude: "Never attribute to incompetence what could be attributed to malice with plausible deniability."

That's a maxim I apply in general, but given that we know there are, in fact, known malicious actors purposely introducing flaws to security software, I think it might be a mistake to reflexively apply it here.

I would be going with this one. A simple mistake has far less drama.