It's slightly "way more complicated". They occasionally forgot to update the key settings between messages, resent identical messages with different keys or encryption systems, or just chose easy to guess keys.

There was also a defect in enigma where no letters could be encoded as themselves. This meant that you could use knowledge of what was likely in a message at a certain location to rule out keys, since any letters in common disqualified the guess.

I believe that was Lorenz, not enigma. The higher level code. Basically Hitler and his generals only.

An operator missed a letter in a message. He then reset the machine and re-encrypted it. 2 almost identical messages like that were enough to figure out how the encryption operated. They didn't see a physical Lorenz machine till after the war.

With a slight error somewhere in the middle of the second one. Or so I remember.