There is a big difference between having agent review a codebase that several people know very well and have a good understanding of, and a vibecoded project where knowledge of the codebase is basically nil. This is especially true for safety critical software where oversight in the codebase can have dramatic consequence. How can a contributor fix a vulnerable subsystem if he does not even know that the subsystem exist ? This means being entirely reliant on agent to be able to find those flaws and to code without them.