On the Unnaturalness of Cryptographic-API Misuse