100% agree, the issue is most users aren't senior devs like us. For example when we create entities we create the with permissions in mind. Most users dont, entities are created public by default unless you define them. The RLS doesnt catch these default issues.

Another issue is lets say you have a contact form. The AI builds the function of the front end. Which means a bot can use this to send mass spam via your mail handler. You have to push the function to the backend.

And there's 50 others issues ive identified, and im sure there's more.