Salesforce gave every org the same free scanner. Attackers already know what it misses.

A defense every attacker can rehearse against isn't a defense. It's a false sense of security.