LLMs are now smart enough to simply download the code of any project they want to inspect. So this argument doesn't really hold up anymore …

Sure, but will they download the right version? And will they be inspecting the right files on disk? There's a whole lot more that can go wrong