Security folks have understood this math for years: there have always been virtually infinite vulnerabilities in production software. Better researchers find them in any repo rather rapidly. The only thing keeping folks safe has been the limit to the research against any given repo that any highly-capable researcher would devote.

As the cost of research approaches 0 via AI tooling that approaches highly capable (and now tireless) researchers, the rate of findings will increase, as will the rate of subsequent incidents.

What remains an open question is whether in-production code quality can improve sufficiently over time to return to a state of relative security.