Part of the issue here may be the policy of "need to know" for these high profile secret systems. If the only person who "needs to know" doesn't know what they're doing then the proper audits of the code will never be done.