Unless you're a low level kernel developer, then it's both!
(Jokes aside, it's still much, much more often not than it is, but it definitely does happen.)
Or you're working in cryptography code and have to fight against compilers optimizing away sensitive stuff [1] - or adding junk back in [2].
[1] https://www.redhat.com/en/blog/security-flaws-caused-compile...
[2] https://pqshield.com/pqshield-plugs-timing-leaks-in-kyber-ml...
Unless you're a low level kernel developer, then it's both!
(Jokes aside, it's still much, much more often not than it is, but it definitely does happen.)