This is really a best practice that we would have expected to see when there is an IT project. In this case, there were 177 releases to the application. We focused in on the 25. The numbers you're referring to are really what we focused in on, which was the 25 major releases, which meant that there was a significant change happening to the ArriveCAN application.
You would normally expect to see a plan for good user testing to ensure that the application is operating as intended, and you would document the results of those testings and any corrective measures if needed. When we looked at those 25, we found that 12 of them actually had nothing documented. It doesn't mean the testing didn't happen, but there was no proof that testing had occurred.
What the risk is there is that you release an app that isn't functioning as intended and, in fact, that's what Canada saw at some point, when 10,000 travellers were incorrectly told that they needed to quarantine.
We would expect that the department would have done all this testing and documented it well before releasing a change to the application.