AI finds security bugs faster than they get fixed. Should the 90day rule change?

I want to disagree with the entire premise on a technical basis.

Wouldnt it be more costly, in terms of tokens, either local or service provided, to analyze a code base and exploit the vulnerability remotely, than it would for a maintainer of said code, to analyze their code base and issue a patch ?

They should both have equal analysis capabilities. Playing field seems level there.

Exploiting is surely more costly than patching ?

Couldn't a well funded repo entity like github just do this by default, in the background, and send a notice to the maintainer of every single repo ?