Is the point that you're making that it only found the vulnerabilities because they were in the training set, and therefore AI didn't really "find" them?

If so, I fear you're making the opposite point, which is that AI made genuinely new discoveries that were not in its training set, about codebases that were in its training set. It quite literally expanded the horizon of what we know.