More like companies can spend the money to have AI scan everything and pick off all the low hanging fruit. I work on a legacy codebase and these new AI tools are finding mountains of very stupid very serious security issues. After we finally get through them we will have a codebase that has no easily found exploits left.

Not exactly imo, you could spend a crapton of money with white box pen testing with a bunch of frontier llms, and it might become a bunch harder to break into (it generally costs more to attack than it does to defend). Not to mention formal verification might become possible for more devices which might make it nearly impossible to find exploits.