Identifying a vulnerability that can be exploited against many thousands or millions of targets is perhaps more attractive than a single one of individually low value.
This of course would assume that vulnerabilities are in fact unique (which is admittedly questionable).
See e.g the lock screen gap that another commenter noted in a nearby thread.
Although everyone might use their own flavor of "database" or "REST API", I can't imagine every layout to be unique enough to not have similar exploit classes entirely. AI isn't known for being super original after all...
(Appreciate your counterpoint for its own sake. It’s an interesting idea.)
Besides that, one could easily imagine software created for similar purposes ("make me a file editor") by the same tool or handful thereof (claude and a very small "etc" for completeness) might share similar vulnerabilities, so this kind of broad net might be even cheaper to cast than one might imagine at first.
Yeah, I don't think all that generated software will be as unique as people expect.
Considering it will be generated with the same LLMs that all share roughly the same training data we will se patterns of vulnerabilities will also be similar and so easily exploitable.