Source code is no longer the attack surface. The binary is. And most security teams aren’t even looking at it.