I’m not looking to argue about your position, but I think the inciting incident in the OP shows evidence that LLMs are “dumb” even when they have the sum total

I’m not looking to argue about your position, but I think the inciting incident in the OP shows evidence that LLMs are “dumb” even when they have the sum total of written language and code at their training disposal. In this case I would expect, for your supposition to be true, that an LLM would not mistake a code comment for an actual vulnerability.