I always assumed that part of the reason you mandate pre-commit code reviews was to protect the business from a rogue developer. If you have a developer who is empowered to merge code that is continuously deployed to production before a code review is done, that developer could code something that exfiltrates data and could do a lot of harm before it's rolled back.
This insider attack is clearly viable since something like this happened with the recent Twitter hack of verified accounts.
I think this point is addressed in the article: they mention that you can (should?) implement reviews post commit, but before the code reaches production.
This insider attack is clearly viable since something like this happened with the recent Twitter hack of verified accounts.