The point is this: vulnerable code often makes it to production, despite the best intentions of virtually all people writing and reviewing the code. If you add a malicious actor standing on the shoulder of the developers suggesting code to them, it is virtually certain that you will increase the amount of vulnerable and/or malicious code that makes it into production, statistically speaking. Sure, you have methods to catch much of these. But as long as your filters aren't 100% effective (and no one's filters are 100% effective), then the more garbage you push through them, the more garbage you'll get out.

the OPs point about who allows the AI to do stuff without reviewing it is undermined by reality in multiple ways

1. a dev may be using AI and nobody knows, and they are trusted more than AI, thus their code does not get as good a review as AI code would.

2. People review code all the time and subtle bugs creep in. It is not a defense against bugs creeping in that people review code. If it were there would be no bugs in organizations that review code.

3. people may not review or look only for a second based on it's a small ticket. They just changed dependencies!

more examples left up to reader's imagination.

Only if you don't examine that proposition at all.

You still have to review AI generated code, and with a higher level of attention than you do most code reviews for your peer developers. That requires someone who understands programming, software design, etc.

You still have to test the code. Even if AI generates perfect code, you still need some kind of QA shop.

Basically you're paying for the same people to do similar work to what they do now, but now you also paying for an enterprise license to your LLM provider of choice.

Sure, if you don't care about quality you can put out code really fast with LLMs. But if you do care about quality, they slow you down rather than speed you up.

The most efficient way per whom, AI stakeholders and top managers?

It depends somewhat on how tolerant your customers are of shite.

Literally all I’ve seen is stuff that I wouldn’t ship in a million years because of the potential reputational damage to our business.

And I get told a lot by people who really have no idea what they are doing clearly that it’s actually good.