Semi-related: I posted this yesterday: https://news.ycombinator.com/item?id=45828917

Different models perform differently when it comes to catching/fixing security vulnerabilities.