I have the opposite view: these vibe-coded projects are MUCH higher security than even top-talent human.

Ask a top agent today to create a to-do app and watch it deploy enterprise grade security: anti CSRF, XSS, CSP, secure cookies, HMACs, rate-limiting of logins, and all kinds of things you never heard of.

I've asked it to implement a simple OAuth and saw it classify inbound IPs for private/public subnets, and put in workarounds for very theoretical DNS re-bindings attacks.

We all know LLMs love to over-engineer stuff, they are having a field day turning your static 3 page blog into crypto-exchange grade security.