What Distinguishes Insecure Design Patterns From Implementation Defects