It requires you to go deep in both the code analysis and the research, which is expensive at their scale

And, as someone who's start up (EdgeBit was acquired by FOSSA recently) wrote a new JS/TS static analysis engine, it's just hard to get correct.