Ultimately, I would say it favors the defenders.

Right now, we are in this transition phase where models discovers tons of latent bugs everywhere. That makes it easier for attackers of course to find a single bug, and lots of fixes means lots of things to reverse-engineer in the patch-gap. But that won't be going on forever, as the number of bugs to find here are finite. Assuming that we use the same models/techniques to scan all commits being made, we'll end up with a codebase that is much much safer than what we had before.