Yup don't expect up-to-date practices and always come with the expectations that your security will be flawed.

gemini 3 deepthink + 5.3 xxhigh code audits catch a lot. Materially better than six months ago on the security side.

Also, yes. Still something that needs expert oversight.