Cheaper and more fungible. Companies pay lots of money for mediocre security audits. Most attackers aren't very good either. However it only takes one good attacker.

If the attacker and defender are using the same AI model, then (up to some inflection point) whoever spends more finds the most vulnerabilities.