This is the best technical analysis I have seen, so far.

https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

It doesn't appear that Coinkite, the company behind ColdCard products, had a mature senior engineer in the loop. At least, no engineer who could immediately flag such sloppy code commit practices. This sort of thing is ongoing, as we can see in commits made this week, even.

Clearly seems like a corporate culture issue. A very low bar seems standard practice.

The root cause seems to be known, unlike what this article implies. A bunch of other articles discuss the entropy issue, https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt for one I found quickly.