> what matters is if it works and is secure.

How do you know it works and is secure if a lot of the code likely hasn't ever been read and understood by a human?

There are literally users here that say that it works.

And you presume that the code hasn't been read or understood by a human. AI doesn't click merge on a PR, so it's highly likely that the code has been read by a human.