I always assumed that part of the reason you mandate pre-commit code reviews was to protect the business from a rogue developer. If you have a developer who is empowered to merge code that is continuously deployed to production before a code review is done, that developer could code something that exfiltrates data and could do a lot of harm before it's rolled back.

This insider attack is clearly viable since something like this happened with the recent Twitter hack of verified accounts.