The scope of nixpkgs is nixpkgs. If every package's entire source code was being audited, then there is no such thing as a sustainable repository of software. There simply isn't enough people, or money for AI, to do it.
OpenAI and Anthropic both provide free credits for OSS.
Smaller models feasibly can review every commit IMO. Would not be cheap for sure, but also would probably be cheaper than a single fulltime employee.