What it asks for. This category, new in 2021, covers weaknesses that stem from missing or ineffective security controls in the design itself, as opposed to implementation bugs. A perfect implementation cannot fix an insecure design, because the needed control was never specified.
In practice. Good practice is a secure development lifecycle in which security requirements are defined early, threat modelling is applied to critical flows such as authentication, payments and access control, and secure design patterns and reference components are reused. Business logic limits, such as rate limits and transaction caps, are part of the specification. Teams write tests that check abuse cases, not only expected use. Evidence includes threat models, documented security requirements, design review records and abuse case tests.
Common gaps. Common gaps are threat modelling being skipped under delivery pressure, missing limits on business processes such as resource consumption or bulk operations, and security being added only at testing time. Design decisions are often not revisited when features change.