In certain industries, compliance/lack thereof has serious consequences, so it might be more to do with that rather than punishing non-technical users just for using AI. For example, if an AI model trains on your internal financials, and someone else uses it to make a quick buck, then that's insider trading. Things like that.

Good security policies always contain building blocks. If your security realies on low-privilage code been fully human-auditted, you've already lost.

Only select high privilege code, where we don't know how to make it "secure by construction", should depend on full audits.

The right use-case here is "custom homegrown Bloomberg Terminal add-ons", not autonomous trading software that can see everything and also isn't routed through trading risk software.