> Most security errors are the kind that that the tools catches

There's plenty of common logic errors that static analysis can't catch.

They may not be readily exploitable by automated scanners, but it doesn't take a nation state.