This is the classic precision versus recall discussion. The discussion centers around how you think about the cost of a false positive versus false negative.
Some people think it's fine for the process to have low precision but high recall. Low precision is that of the number of conversations the process flagged as a positive, some unacceptable (to you) percentage turned out to be a not/false "positive". High recall is that of all the actually positive conversations, the process flagged an acceptable (to you) percentage of them as positive (i.e. only "missed" a few/false negative).
What does it cost to wrongly identify conversation a positive when it's really not a positive (false positive)?
What does it cost to wrongly identify a conversation as a negative when it's really a positive (false negative)?
I think there is a tendency to project the modern era's speed of technological progress back in time, which isn't reasonable. We went from the Wright Brothers to Apollo 11 in 66 years. The first transistor to the iPhone in ~60 years. That rate of development is...new.
In my experience, you can weaponize processes like the Five Whys or the Amazon Leadership Principles. I don’t think that means they don’t have any value.
That being said, in this case, I agree with your manager. Both the QA team and your team had fundamental problems.
Your team (I assume) verified the functionality which included X set of changes, and then your team made Y more changes (the flag) which were not verified. Ideally, once the functionality is verified, no more changes would be permitted in order to prevent this type of problem.
The fundamental problems on the QA team were…extensive.
The problem is that these companies are locked into years long, multi-billion dollar contracts with the sports leagues. Those contracts are predicated on their existing monetization model. The economics of those contracts no longer make sense if the model changes. A lot of money is on the line. So they are going to fight hard.
The government (and/or society?) have already deputized private organizations to enforce various types of controls either implicitly or explicitly. Banks (AML) and Payment Processors (recent Steam content removal news) come to mind. Irrespective of whether it's a good or bad things, it already exists.