That's fair, but I guess the question is whether analyzing each commit can find vulnerabilities or it takes more than that (aside from using Google models). It is possible they might have dismissed Sashiko review because they thought it wasn't possible or didn't make sense.

Then the question becomes how many vulnerabilities Sashiko didn't catch (If they use/review Sashikos review)