Comment by dave_sid

Exactly. I think this is it. Clearly separate what must be perfect and well understood (security, business logic), from bits that you are happy to throw some code at and see if they work. And don’t let the latter get its hands on the former. I think going back to OOP principles and SRP/separation of concerns can make this work. Just some conscious planning needed rather than handing over the reins entirely.