I do think that people may let code be generated without really thoroughly checking every part of it and I see that as a problem.
That, in my opinion is a new "untrusted input" attack vector and it will abused (probably even more easily than how the recent xz backdoor happened), by either targeting the training data, using prompt injection or in other ways.
The scary part about it is that any contributer/commuter themselves is considered a "somewhat" trusted entry but if it is assumed that everyone uses code generation AI that entity cannot be trusted anymore.
At the same time, since all the AI generated code has to be thoroughly checked/reviewed, the assumed productivity gains are somewhat diminished.
I think how it will actually play out though is that security concerns will just be largely ignored as it often goes.