If you believe you can find even just all unintentional bugs, let alone deliberate security vulnerabilities, you've never looked at the underhanded C contest [1].

> All you have to do is view the changes/new commits every time you want to update.

These can be thousands of lines of code per day in busy projects.

[1] https://en.wikipedia.org/wiki/Underhanded_C_Contest