Well, that surely also depends how big the company is.

This mistake looks like he just started coding.

The only thing experience will do is decrease the frequency of errors. I mean this is why there is a movement to prepared statements and safer language. None of us is smart enough to sanitize correctly or avoid buffer overflows.

> None of us is smart enough to sanitize correctly

It's just something that isn't and shouldn't be a concern of most engineers. I don't care about these things in terms of solving them.

You entrust the collective wisdom in each area like security for these types of things.

Which is exactly why it's hard to believe a former Facebook, veteran CTO would commit some code like this.

No legitimate electrical engineer would do the equivalent.