Isn't the difference just harness then? I can write a harness that chunks code into individual functions or groups of functions and then feed it into a vulnerability analysis agent.

It's probably not the 'only' difference, because clearly the models are advancing in capability, but it's likely way more important than generally given credit for.