So I assume that most of the backend did actually surface error codes via the HTTP layer, it was just this one endpoint that didn't

How is this getting even worse still? Why would a single endpoint work differently? That suggests they have standards, just one arsehole decided to shit on it and the rest didn't vet their code enough to catch the issue.

otherwise basic testing would have caught it

I worked QA in a small dev team for two years. You might be surprised how uncomfortable you can make some developers within five minutes of "basic testing". By the time I left, the team lead loved me as much as some of the devs must have hated me.