I completely believe this, but you could also run auto mode classification in manual mode and tell the user the result.

Or even reject anything auto mode rejects while still allowing the user to reject things auto mode accepts. If what's approved is the intersection of what the user is approving and what auto mode thinks is safe then it would be strictly safer than either mode alone.

This would also be a way for users to gain confidence in auto mode before going all in on it.