In general security sensitive software is the worst place possible to use LLM:s based on public case studies and anecdata exactly for this reason.

”Do it the hard way”

Yes that’s generally the way I do it as well when I need to reliably understand something but it takes hours.

The cadence with LLM driven experiments is usually under an hour. That’s the biggest boom for me - I get a new tool and can focus on the actual work I’m delivering, with some step now taking slightly less time.

For example I’m happy using vim without ever having read the code or debugged it, much less having observed it’s callgraph. I’m similarly content in using LLM generated utilities without much oversight. I would never push code like that to production of course.