The five-year bug escaped detection because auditors verified that the intended random number generator existed, but not that it was being called.