He let's the company off the hook here. This was probably some intern or jr engineer under ship pressure. Devs need help understanding their code. As a test engineer this is worse than a mistake, it looks like criminal negligence. When you create a verification matrix the first thing you consult is the things you promised your customers. Marketing points in this case. If you say you have 256b of entropy supplied by a hardware element, your test must verify those things after any significant design change, to as high a level of real world veracity as possible. Anyone who signed off on this code or the (lack of) verification process is potentially criminally liable. You are not reasonably expected to find every bug. You ARE reasonably expected to verify your marketing points. A simple entropy test, or even just polling the hardware element logs to verify they are actually accessed, would be a very basic hardware in the loop test I would expect as a minimum for this kind of product.