I made a CTF problem where `assert` was used as a critical safety check - and where "accidentally" running the program under -O (for speed!) resulted in a security vulnerability. A large fraction of the people who attempted the problem seemingly missed this bug.

I would not be surprised in the least if that pattern existed in the wild. In fact, it's quite common to see this in C/C++ codebases too: people will use assert() to check a security-relevant property, and then disable those checks in their release builds "because it can't happen".