90% of code wouldn't pass a basic audit, let alone any sort of regulatory scrutiny. Developers are building the easy version most of the time.