It's very common for developers to mess up authentication. It requires a fundamental understanding of protocols. What makes it worse is that an incorrectly implemented protocol doesn't break the integration, it just breaks the security benefits.

A pen test mitigates that risk.