Actually those two stances are NOT incompatible. I'm not sure they're both true, but they might well be.
Finding a code exploit is a task with an easily validated result. That's where AI is best.
Writing code that doesn't have exploits doesn't have a easy check. So AI is not as good there.
You could use a harness to check for exploits after you wrote the code, but that increases both time and cost, and isn't guaranteed to find all the exploits. (People and AIs think differently, and don't recognize all the same patterns.)
This will probably change. AIs have "jagged competence", but the areas that they are weak have been getting stronger. For now, however (and as I understand it) there are still many areas where humans are more competent than publicly available AIs.
It's quite plausible that sometime next year Yang's reported claims will be appropriate. OTOH, that would imply massive other changes, also. And it's also possible that the claims will still be exaggerated.