> not on line-by-line source code

I think there's a bit of a false premise around "line by line".

I don't need to syntactically parse every line to scan it for the the type of risks that matter here. You can look high level and see the pattern and shape of the code, the type of things it is doing. If it is doing stupid things ("Wait is it making a new connection to the database inside the loop here?"). It does take an experienced eye, but with that experienced eye it is a very rapid process.