A builder I spoke with had a reporting feature in his app, working exactly as intended for close to three weeks: users logged in, requested a report, and got a nicely formatted result back. Nothing about it looked wrong from inside the app itself, because it wasn't wrong from inside the app itself.
What his testing actually covered
He'd clicked through every screen, tried it as different test users, and it behaved correctly every time, because every time, he was going through the app's own interface, which did check who was logged in before showing a report. What he hadn't tried was calling the underlying API endpoint directly, bypassing the interface entirely, the way a browser's developer tools or a simple script can do in seconds.
What we found
The interface checked permissions correctly. The API endpoint behind it, the actual thing doing the work of generating the report, didn't check anything at all, it would generate and return a report for any account ID handed to it, logged in or not, as long as the request was formatted correctly. The interface was a locked front door on a house with an unlocked side entrance nobody had thought to check.
Every click through the app looked fine. The interface was never the actual gate.
Why this is such a common shape of gap
It's genuinely natural to test an app by using it the way a user would, clicking through screens, filling out forms. The API calls underneath are largely invisible unless you go looking for them specifically, and permission checks are sometimes added to the interface layer without a matching check added to the underlying endpoint doing the actual work, especially when a feature is built and iterated on quickly.
The actual fix, and the lesson
Permission checks belong on the endpoint that does the work, not just the screen that calls it, since anything reachable by the interface is reachable directly by anyone who knows or guesses the address. He fixed it within the day once it was pointed out. The broader lesson: testing by clicking through your own app tells you the interface behaves correctly. It tells you nothing about whether the layer underneath does the same.