I assume that "defensive AI" means finding and patching vulnerabilities before attackers do, not some kind of live LLM packet-inspection.

It is possible to write more secure software[0], companies just choose not to prioritize security.

[0] https://cr.yp.to/qmail/qmailsec-20071101.pdf