Computer science says to such thing. Roughly speaking, the impossibility theorums you are likely thinking of say that "there are correct programs which are not provably so".

Exactly.

There is typically no algorithm to correctly decide yes/no on a vulnerability for any input program. But there are algorithms that can correctly report maybe/no. The trivial example: the algorithm that always reports "maybe".

The field of static analysis is about improving on the precision of this trivial algorithm so that it reports "no" whenever it can, within resource constraints.

There are no general algorithms that can report a "no" to general source code. The maybe is obviously not considered in the context of this discussion thread about ML. It is obvious that ML. A simple search on Internet could give you resources like this: https://arxiv.org/abs/2110.09610

> The maybe is obviously not considered in the context of this discussion thread about ML.

What do you mean by that statement? The only thing ML can do with a decision question is report "maybe" with some confidence. For example, "I am 98.3% sure this image has a cat in it, with respect to the data sets I was trained on" or "I am 77% confident this source code misuses a web request API, given the examples and non-examples of misuse that you have shown me."