maybe because they are only using AI as an automated vulnerability scanner (as a blue team), and not using an adversarial mindset for threat model development of an offensive attack.