Is it possible that there's also just more software in different domains being written, hence making it more difficult to keep track of everything that is going on?
Shouldn't be. If I recall correctly, the process was fairly logical. One of the things you wrote down in your design doc was all the external surfaces (endpoints) your application/service had and how you were securing them.
You could literally not ship anything without this review, so they must have abandoned the process by now. Or just never extended it to "the cloud"
