I doubt that every company could hide malicious code so well that AI can’t find it.

And who said it need to be new concerns? Are the old ones resolved and are they not enough?

Why would it need to be "new"? What does that even mean? It's relevant, it applies here, that's more than enough. And it would be brought up with any company if they dropped 1.3 LOC directly after nothing but a "promise" to delete data they took.