If you strip away all the jargon about 0days and "IDOR" and whatever, you are left with this.
Vulnerabilities arise either because we didn't know about a potential threat yet, or because we keep doing the same old shit.
Structurally, AI is capable of finding the latter.
The latter should not exist, but we invested everything in trying to find each one individually instead of stamping them out at the root, because developing the practice of software engineering is apparently impossible.