This would show the effect you want. Code like tests are likely to be very verbose, while often the actual vulnerability will come down to a handful of characters.
I was thinking of ROI for reading code. Regularly having a one line issue in a 100 LOC file is very different from a two line issue in a 10'000 LOC file.
And yes, tests need to be excluded, of course. But looks like that's done?