Can CodeQL queries be insecure? This makes sense as a linter, but not sure about the security value proposition.

Edit: missed what day it is

I mean, it's arguably a security concern if you're not catching the mistakes you intended to catch.