BOLA requires a missing check on every request. BFLA requires a missing role check on specific endpoints that were never designed for regular users. The failure happens at design time: the developer builds an admin endpoint, assumes it’s internal-only, and skips the authorization check entirely. There’s no “wrong” check — there’s no check at all.