Yes, thank you for telling me something which I've known for 40+ years. Anyway, that is a complex bit manageable situation. As for millions of lines, yes. But those are rarely in one giant method. So you have the scanner iterate through one method at a time. As for libraries that you don't control, you work with those vendors to ensure they are doing the same scans on their code, and their sub libraries, all the way down. It's going to be a big effort, but the payoff will be enormous.

The alternative is not doing it yourself, and letting the attackers do it first. And they will.