What makes you think RCEs are being found & fixed at a rate that’s faster than they’re being introduced?

I could see it going either way.

Why would the model not find the vulnerability during implementation or testing before release?

If it requires a lot of compute and trying, this is something that could be provided for common software.

Those companies that produce more RCEs than they close will sink and those that don’t won’t.