I know there have been numerous reported WordPress vulnerabilities recently, and a lot of those are the result of more advanced AI scanning, but I was wondering if those were mostly reported by outside researchers or by internal maintainers?

I like Linux's approach, where kernel maintainers have built their own machines to intelligently rove over the kernel code to (hopefully) find vulnerabilities before attackers do. They are finding hundreds of real Linux vulnerabilities every week, some of which have existed for 20 years. I have wondered if the same is being done by WordPress maintainers.