Are insecure code completions a vulnerability?