I think your expectations may be a little out of date. Existing models, including open weight models you can run yourself, are already quite incredible at finding defects. Even if the technology never gets better (it will) we are already at the point were LLM-wielding attackers have a dramatic advantage over non-LLM-wielding defenders.

There is no excuse for not having an LLM look for flaws in your codebase. Your attackers are using them already.