It's also always easy in hindsight to see code and think "that's an obvious flaw if it was reviewed." If it was so obvious why was it written to begin with? Every time I git blame a piece of idiotic code and see *my* name I wonder WTF was I thinking. It happens because at those times I didn't know then what I know now.
Of course in a perfect world every line of code would be independently audited before shipped. Every piece of software would be developed to the same standards that NASA wrote the code that powered the space shuttle. Unfortunately, that world is one in which none of us would ever be able to afford the software.
Every time I talk about security, I never talk about if but when. That's why all PII data should be encrypted at rest, passwords hashed and salted. So when a security lapse occurs it's possible to minimize the fallout. Clearly Apple has learned from this situation. The announcement that verified security researchers will get rooted developer iOS devices shows that Apple is serious about improving this process.