> I suggested to the client that if he still resists having another professional audit it, at least let some frontier LLM have a look. Yes, I recommended this guy to vibe code his security-sensitive code because "professional developers" today still miss the basics.

Amen. Nowadays it is borderline malpractice to not use a coding agent for checking the security of your code.