It also enables serious security scans and uncovered lots of serious security flaws.

Agreed, although I worry about this use case the most for "brain rot" - that security pen testers will quit thinking and just use LLM agents instead. The state of the art needs both, not just one or the other.

Coders with brain rot only have to make working code that fulfills all the requirements, security scans have a much higher burden, and they are also more directly linked to expensive problems when they fail in their task.