It's just a rule of thumb, not an absolute. I tend to believe most developers are just doing a job (good or bad), and not out to get someone. So to me it's a numbers game where one explanation seems much more likely.

It's not that difficult to put in something much more subtle and still have deniability if the intent was malicious.