Hated as they may be, I believe they’ve changed the way we think about code review. The fact is that there are malicious actors out there, likely far more advanced, and in positions of far greater trust. Modern devops has nearly eliminated human code review in favor of functional unit tests, and security is maybe something considered at release testing. And although the Linux kernel devs may be able to catch these things, there are countless other projects now realizing that they would not have. I don’t think humans can do this. We need to develop better automated tools to test for security in continuous integration of individual commits. For instance, it is normal for CI tools to include functional unit tests for interface implementations, but certainly less so to fuzz every interface as well. I don’t think it’s sufficient to simply fuzz the user inputs. A baked-in exploit would never be discovered that way.