I doubt that every company could hide malicious code so well that AI can’t find it.

And who said it need to be new concerns? Are the old ones resolved and are they not enough?