Like the fake facebook that had a security hole so severe every single participant had their API keys exposed?

Yep, that’s the most prominent example of a system built without code review I can also reach for. Whether all such systems also suffer critical flaws is another question entirely. And whether that matters is a further unknown.