I think all of your questions are contingent on how good the tool is. FWIW I have built a POC of this for my consulting company, to help identify possible vuln

I think all of your questions are contingent on how good the tool is. FWIW I have built a POC of this for my consulting company, to help identify possible vulnerabilities. With or without proper context LLMs will hallucinate both potential and false positive vulnerabilities that you have to manually check through. This would be fine, except it's like a DDOS attack, where you now need to check hundreds of places every thousand lines of code. I am not aware of a good way for LLMs to rank their potential vulnerabilities, so often times it shows really ones that are unlikely, while missing more complicated / nuanced ones.