@dsalo if you've ever worked with a static analysis tool on a large codebase, "reported vulnerabilities that have a chance of being significant" are a dime a dozen. The hard part is triaging the massive number of mostly not meaningful reports and finding the handful of ones worth addressing, and the extra extra hard problem is doing this in a way where you can keep running the tools without having to repeat the whole audit process every time.
AFAIK Mythos doesn't address either of these points.