I suspect this would disincentivize operators to take care in the way they write their detection rules, and the nondeterminism of the LLM would then result in false negatives. So the rate of growth of the needles set would increase, and the analysts would be getting lower quality information mediated by the LLM.

In a world where false negatives--i.e. failing to detect a sharp needle--are the worst possible failure mode, approximations need to be handled with exceeding care.