Very much this, it’s all the technical rigour, code debt, and none of controls/reversibility.

At least when I report fraud to credit card or my bank, they can stop or undo/chargeback a transaction.