Vulnerabilities can still be discovered in the compiled code, but they are easier to discover in the source code. Simply running a static analyser on the code will probably point out numerous possible vulnerabilities already.