"Code must be written by hand" is not at all incompatible with "use agents to scan for vulnerabilities", or for that matter "use agents to find bugs", "use agents to help with profiling to give you data for optimization", or any number of things that aren't writing the code for you.

There's no point in using agents to find vulns if you don't have time to fix them all (you don't)