Yes, actually at my job a co-worker just found exactly such a bug yesterday: Debug build zeroed out the variable and the release build didn’t. So the bug only occurred in the release build, but could not be reproduced on the debug build where the developers work on. So in the end he found it because of the different compiler flags used for debug vs release builds at our work place.
They only logged the IP. That’s metadata. IIRC Apple refused backdooring its phone encryption. That’s a lot more invasive.