Or something about packaging. Or I used a function that has a different implementation for debug mode out of its intended purpose. Or

Only thing worse is not finding the bug that only happens in release mode

I don’t follow your thought process. I didn’t say every running process could kill the lock screen or if it can kill the lock screen it can access everything else, I said any process that kills the lock screen has to be running. And as the attacker with physical access doesn’t know the password they can’t run anything to kill the lock screen. The only way for them to unlock it is if they already have malware on the device, in which case their physical access isn’t the cause of the problem.

How so? The lock screen is to prevent physical access while you’re away, and an attacker can’t kill it without having access in the first place. Any process that can kill it would already have access to your session.