What about checking crypto libraries for gaps like the coldcard situation of RNG code is correct but not in the release build somehow?

That was such a stupid coding/code review/testing mistake. Finding it is not that impressive at all. It's nothing like finding a flaw in AES