I work in a similar environment. Most of our projects lifecycle we were 4 devs who knew each other reasonably well and all had high trust in each other. Unless it was a one-liner or a hotfix at 4am did get merged without a code review. Most if the reviews were just hitting the checkmark, things look fine done. But sometimes someone makes a mistake, as is human. In that case we caught it before it hit master.