And what about the false-positive rate?

Yeah, this is the critical question. If the model ends up flagging too much, that could end up being like a manual read of the code.