By the same token, if there's little accountability on the project, one might intentionally leave a debugging mechanism in for dubious purposes because they feel they have deniability if/when it's found. "Oh sorry, just a debugging thing I accidentally forgot."
It's just a rule of thumb, not an absolute. I tend to believe most developers are just doing a job (good or bad), and not out to get someone. So to me it's a numbers game where one explanation seems much more likely.
It's not that difficult to put in something much more subtle and still have deniability if the intent was malicious.
