I also notice these cases tend to be missing good test coverage (at least in my experience)

I think part of the assumption is "hey there's a flag I can control if something goes wrong so manual validation is ok here" but that doesn't help when the thing is left for a period of time and everyone loses context.