alt Hacker News> some bugs you don't want to find
The key thing you forgot, which makes this approach non-sensible, is the omniscience, without which you have no clue whether your posture towards a new bug-finding tool is good or not, since you don't know whether it will mostly find those bugs that are not worth fixing and the time wasted on fixing them is detrimental.
Similarly, how is ignorance better than informed decision when ignorance also includes missing critical security bugs?
Same as we do medical tests: We define some bar a test must meet and then the population, if any, it is applicable for and especially the population it is not applicable for because the curse of knowledge exceeds the benefit (eg: breast cancer screenings not recommended for people under 40 or over 74).
This isn't an argument against all automated bug detection, just that it needs to exceed a threshold beyond just "It has found at least one real bug not found via other means" which is the seductive threshold people want it to be.