Im not sure why it being caught by accident is a factor here.

If devs knew what the pitfalls were before coding, there wouldn't be security risks in software.

Hackers do the same thing. They pen test, and if by chance they find something, they exploit it.