I can't imagine how delusional a person has to be to think it's even possible to review codebases as large as that. They'd need years to go through everything
You'll have to trust the developers (not the reviewers) to point out these spots and at that point the review is pointless as the developers could've told you the same thing.
It's just a security (or in this case quality) theater to make some people feel important if that's how you do it.