Right, because all these companies and developers are all so nonchalant about pumping out arbitrary code changes, because they have never learned that even small changes cause huge issues despite having experienced it countless times, sometimes to losses of millions of dollars!

There's also c) use your own agent to take the vulnerability and get back to you with an assessment including whether it managed to devise a working exploit, and you go from there.

Or do you have doubts about the ability of these things to devise working exploits? ;-)