I figured LLMs nowadays would be good enough to catch issues like this. Is it because it’s too costly to do it?

Yes if you use LLM to analyse everything. Not really if you analyse diffs, with heuristics to select candidates for LLM/agent based analysis. But at the cost of missing out novel attacks.