Surely with AI it should be possible to go in the opposite direction, and use reverse engineering software to reconstruct something like the original source code, and automatically check for functionality differences. So then you only have to trust your RE software (and your system environment etc. I suppose). Would that be easier?

That still assumes you can detect the differences which could be heavily obfuscated. And assumes your reverse engineering toolchain isn't infected with the same issue too. While this route is a bunch of work, it does give you good confidence. That doesn't mean you shouldn't do other things as well.