As someone who has done a fair amount of testing over years, not software testing, but network and data traffic testing, engineers are often times bad at testing these things.
Software engineers often are terrible at software testing, things that seem elementary or obvious to them are often times lost on the end user.
I’m an end user administrator. It’s amazing what we can do to try and break the system or get around security.
What’s more is that about 50% of these can be prevented/solved with good technical instructions.
I wish they added technical writers to this list.