What's preventing cal.com to run the AI researcher over their own codebase and find their vulnerabilities before anyone else and patch them all by tomorrow morning?

That's right. Nothing.

Unwilling to pay AI tax, maybe?