Neither "shutdown the company with bad code" nor "because there is bad code out there AI driven security findings are unworthy" is the conclusion I would come to.