Humans find security vulnerabilities all the time too. The assumption is a lot of the misses are because highly trained security experts don't have time to carefully read and understand all code without fatigue.