Well, software supply chains are a thing.
"where no auditor ever is paid to look" would be more correct.