My problem isn't the bug. Bugs happen. It's that a developer thought that screen scraping a payroll system and setting up a recurring job to overwrite all bank account information in the middle of the night was a good idea.

If you care about security and stability, that should have set off major alarms.

Scraping data and pushing to internal APIs in another product have no spec, so any tests you write are either wrong or not wrong yet.