It makes sense. Even if it finds some exploit on your own code, who's to say you can't reuse the same exploit on some other system?