Checklists exist because they catch the common cases cheaply. The failure mode is treating the checklist as the review, instead of the floor beneath it.
A useful review spends most of its time on the parts of a system that are hardest to check mechanically: trust boundaries, session handling, and the places where an internal service quietly started accepting external input. Those rarely make it onto a checklist, because they're specific to how a given system actually grew.