It depends heavily on how much code there is and what language it's written in. Also, code auditors can often eliminate large swaths of the codebase with high c

It depends heavily on how much code there is and what language it's written in. Also, code auditors can often eliminate large swaths of the codebase with high confidence when it's clear that there is no attack surface, so it isn't always necessary to grok the whole codebase.