I think the other side of that is that mismatches between intention and implementation are exactly where you're going to find vulnerabilities. The LLM that looks at closed source code has to guess the intention to a greater degree.
This is true for a lot of things but for low-level code you can always fall back to "the intention is to not violate memory safety".
This is true for a lot of things but for low-level code you can always fall back to "the intention is to not violate memory safety".