If $typical_software_stacks have had enough "company ending" security issues ... maybe the whole industry have been seriously misguided for decades? Clearly they cannot have taken security serious in any way shape or form.

Neither "shutdown the company with bad code" nor "because there is bad code out there AI driven security findings are unworthy" is the conclusion I would come to.