These counterexamples are comparatively straightforward because the input domain is well-defined and simply-structured, and a counterexample is trivial to verify. The same is not true for arbitrary vulnerabilities.

Yes and no, many people don't have models review the code the same way many humans don't review their own code in depth for security vulnerabilities.

Furthermore, you need to make sure the model you use is capable enough to review your code comprehensively enough. That includes for both basic vulnerabilities but also attack chain related vulnerabilities.

Then a new model comes out two weeks later and finds a hole that your archaic review bot missed