Peer review is absolutely a control layer. Having a review process in place means it requires coordination or at least negligence for a developer to introduce malicious changes into a project. At the very least, peer review can act as a quality gate for production changes.
It's a peer review, Not a control layer.