The limiting factor is pre existing information. It's great at retrieving obscure information and even remixing it, but it can't really imagine totally new things. Plus white hats would also have LLMs to find vulnerabilities. I think it's easier to detect vulnerabilities based on known existing techniques than it is to invent totally new techniques.