Supply chain attacks through distro repos haven’t really been a thing.

Random npm packages are another thing.

If AI is building all the systems and writing all the code, and AI is finding bugs and exploits in existing code and code being generated by AI... With the assumption that any code base scanned in its entirety by the latest frontier cybersecurity focused models is secure... This assumption only holds until a more advanced model is created to find bugs and exploits in the code from the now lesser advanced model... Which means even the code the top of the line model just created was never really secure...

How does this cycle get broken?? Will people ever be able to be sold the (false idea) that their devices are secure?

The implications are extensive.