If we have AGI capable of finding vulnerabilities, then we can just ask the AGI to design a system so secure that even the AGI cannot find any vulnerabilities.
I do think that it'll be easier to find vulnerabilities than to design systems that are provably secure. It's like evaluating a function f(x) vs finding the values of x for which f(x) = 0.