You are likely right the code is not audited, or deployment is not verified. This is a design-level review.

You are inaccurate on "they only interviewed engineers". There are document reviews as well which covers design and architectures.

Source of the report on methodology shared such information.