Engineering is a science. Shitty title is shitty.
Most attacks on secure systems involve attacking the engineering - the implementation of the system, rather than even attempting to break the crypto, even if it is only DES.
What about not using authenticated encryption? Crypto or implementation?
Storing SHA512 of passwords? Using non-cryptographic random number generators?
Care to explain the distinction between a 'cryptographic' random number generator and a 'noncryptographic' random number generator.
A random number generator is a random number generator. Some are worse than others under various metrics. Arguably, random number generators that are ill-equipped to generate high-quality random numbers shouldn't be used at all. For anything, cryptography included.
But I mean, specifically, using CSPRNG (such as an algorithm behind /dev/urandom) vs pseudorandom number generators such as rand() from C library.
You can read more about them on Wikipedia:
There are high-quality RNGs that aren't good CSPRNGs. CSPRNGs need to be fast, ready to deliver results after a cold boot, and unbiased. What you're probably thinking of as a "high-quality" source of random numbers is just part of a CSPRNG (the entropy source).
Conversely, CSPRNGs aren't actually suitable for all random number needs in programming; for instance, in software testing, you want an RNG you can seed and retrieve deterministic results from. If you can do that with your RNG, it's very unlikely that it's not suitable for cryptography.
For modeling you might want very large quantities of random data. It's handy if you can reproduce those same numbers at will. This is a bad quality for a cryptographic random number generator.
"Good enough" really is good enough for many uses. Obviously, that's dangerous for crypto where we want "actually good".