The point is that you're not verifying if you don't even review the code.

Even if your test suite tested every single possible behavior and code path, tests usually can't intercept all possible unintended behavior that an LLM might have added.

In all likelihood, most test suites don't intercept any unintented behavior (such as unintended internet connections).

That's not a big problem when a honest human has written or reviewed the code, because unintended code is usually easy to spot.

But an LLM might have dropped any whatsoever code: maybe some of your project's code resembles the one of a trojan in its training, so it completes it with the trojan.

Or maybe it found that if your server is unreachable, it can upload the client's data to a public Github repo; or that if there's no space left on the device, it can delete some of the user's folders, easy!

Would your clients be understanding if that happened?