I agree with the GP; I don't think code reviews or testing was the problem.
I think the best-practices they violated is that they deprecated and repurposed a flag within a single release cycle. That sort of activity should take two release cycles at least, one to remove the old functionality and one to add the new functionality.
Being so removed from binary and bit level interactions it can be easy to forget things like this.