You want to regulate an industry 90% of whose output is just a bunch non-critical CRUD apps? You haven’t thought out the macroeconomics of that, you’d go hungry faster than you’re being obsoleted in the age of AI

What makes you think people aren't "reviewing" what they ship to customers just because they don't read the code? If the testing goes well that may be all the "review" required.

To be fair, while the threads don’t show it, majority of companies that survive by processing payments. Shopify, Airlines, Rental Car companies, Banks, etc. are still doing and generally can prove at anytime 2 party review is happening on any PCI related code. It’s just that many people don’t work on that, and regulating a new feature for the ESPN Fantasy Football service seems silly.