you can't "just have a really good test suite" your way out of this. security issues are caused by violation of properties you never even thought of, by non-obvious and often indirect interactions of things nobody realised were connected. your tests will not catch this
most test suites are actually not very fine constraints on the system under test; the idea that "any program that passes the tests is acceptable" is nonsense, even more so when you're also generating the test suite
I personally know about 1 person who I think is good enough at testing that I'd let them make this argument
multiple things can be true at the same time. it is true that un- or underpaid people having to deal with complex emergencies under tremendous pressure utterly sucks. it is also sucks that that pressure is a strong incentive to deploy under-reviewed code
"you could do this with AI, therefore AI is the only viable way of doing it" is not true, it is a trap that asserts the only way to deal with problems is blind panic, to surrender control and responsibility for your own work