Design changes de facto are part of the self-cert process because it had no requirement for FAA oversight of post-flight design changes.

DOT OIG disagrees that this played no role. Here's from Page 2 of their report, i.e. the entire "Findings" summary:

While FAA and Boeing followed the established certification process for the 737 MAX 8, we identified limitations in FAA’s guidance and processes that impacted certification and led to a significant misunderstanding of the Maneuvering Characteristics Augmentation System (MCAS), the flight control software identified as contributing to the two accidents. First, FAA’s certification guidance does not adequately address integrating new technologies into existing aircraft models. Second, FAA did not have a complete understanding of Boeing’s safety assessments performed on MCAS until after the first accident. Communication gaps further hindered the effectiveness of the certification process. In addition, management and oversight weaknesses limit FAA’s ability to assess and mitigate risks with the Boeing ODA. For example, FAA has not yet implemented a risk-based approach to ODA oversight, and engineers in FAA’s Boeing oversight office continue to face challenges in balancing certification and oversight responsibilities. Moreover, the Boeing ODA process and structure do not ensure ODA personnel are adequately independent. While the Agency has taken steps to develop a risk-based oversight model and address concerns of undue pressure at the Boeing ODA, it is not clear that FAA’s current oversight structure and processes can effectively identify future high-risk safety concerns at the ODA.

https://www.oig.dot.gov/sites/default/files/FAA%20Certificat...