Why AI-generated vulnerability patches still require expert human review