Instead I mostly read such opinions based on active imagination and no concrete experience with using AI for such work in a setup as described.
Alternatively, if you want to see a benchmark so badly, you can create such a benchmark for your guess. I would imagine you would have more faith in the results of your own work.
That's not what anyone tells me though. I only hear theorizing and vague references to how AI failed people.
You're spot on that the thing I trust most is my own experience. I'm mostly working on mobile apps, my project does not have user accounts, so I couldn't tell you about authentication.
However, it is my experience that these models got very good at catching high-priority issues if you use the review step as I described.
Thus I theorize that SOTA models are likely to produce secure implementations.