Who said those vulnerabilities were found by an LLM?

Because most devs don't want to do formal verified system development. I know only one OS working on that which is open source Ironclad OS hope many others follow this path. It is Ada/SPARK based but others should do with whatever language they are using. NetBSD also heard going to do something similar with C in last AGM

Does this also mean the code generated and reviewed by LLMs will not have such issues going forward?

in theory, it could be the best thing that ever happened to open source.

I'm not super sure about that. But if its going to exist I'm crossing my fingers it works to the OSS community benefits (eventually)

Instead of patching millions of environments, perhaps it’s better to just build a secure one from scratch?

That’s what I did with Safebox: https://safebots.ai/about/infrastructure.html