How does this kind of vulnerability even remain, after code reviews?

Is it hard to spot?