Why would it obviously give attackers the upper hand? If we accept the premise that AI helps find vulns more efficiently, shouldn’t this be at least equally helpful in securing against attacks and make that increasingly efficient?

It won't do that for free, companies (and open source maintainers) will have to pay for the tokens used finding vulnerabilities in their own software. That increases the cost of releasing the same product/feature/amount of code vs what it was before.

everything you build potentially increases the surface area of attack. If the benefit of building it is zero or negative then all you've done is increase your risk profile.

Maybe people believe that the process complexity is not symetric. I don't blame them. Building an house is more complex than destroying it.

It's still an additional cost that doesn't drive revenue.