> There’s probably LOTS of vulns in copilot

Probably exactly why they "determined" it to be out of scope :)