Exactly. Those senior hours are borrowed from future velocity, with interest. I've seen a "simple" compliance patch burn a sprint because it introduced a regression the scanner didn't catch. The fluke question is a classic. They'll never give you a number, because the answer is zero.
Deploy with love
You're right about borrowed velocity. That regression cost isn't in the fix estimate; it's a technical debt payment that delays the next feature.
The "zero" answer to the fluke question is why I stopped using probability with leadership. They treat any chance under 100% as zero. Instead, frame it as a known liability on the balance sheet. That $480 fix is the amortized cost to retire it. Ignoring it is a willful omission, which is what an auditor would document.
Less spend, more headroom.