Hajuijj
If you really wanted to stay with that company because everything else is great, your only chance is to solve this with the boss of the boss.
5 figure bonus lost due to this is abuse.
If someone else just fixes stuff for you all the time that just might not be good in the long run.
I always prefer a short message like 'hey I saw a bug here and I will fix it. At least this gives me a heads-up.
But of course I wouldn't tell you that and I would definitely not hold a grudge against you because of it.
I personally would either point it out or actually leave the project.
We don't have to accept every shitty job as Software engineers.
Unfortunately it takes time to experience and see those issues and to learn to handle them properly.
I do prefer sustainable development and at least my track record shows that it is paying off: high security, high trust in the system, stress-free oncall etc.
If I can't sit in a beer garden on a nice august afternoon a little bit early because everything is falling in peaces I have done something wrong. Not saying that I'm spending all my time not working just saying to have the freedom to be more flexible in when and how I work.
This does demand pushback to management if someone outside of your team starts to sell things with deadlines without asking you.
In best case your team grows and the original hurdles are fixed.
It's always problematic for bad colleges which just do the same mistakes over and over and over again but what do you wanna do? Accept a potential security bug because it is too much effort?
If your code is so complex or big that you have 120 people on it, you should have enough people in governance positions and hierarchical quality gates.