Let's start by taking a step back. Scanners can be useful. They alert you if there is something basic and fundamental wrong with your setup. Forgot a port open? A scanner will tell you. Running vulnerable WordPress plugins? A scanner will tell you. Did you forget to set some security headers on your blog? A scanner will tell you about every single blog post, to show you how diligently it's crawling through your site.
What scanners actually do
But if you have a web or mobile app, a clean scanner result is not something to be confident in. The way traditional scanners such as Nuclei work, is that they take a template of a scenario that they want to test. This could be visiting a certain path on a website, sending specific crafted requests, or just inspecting the website's code. The template then parses the response or content that the scenario is looking for, and decides whether a vulnerability is present or not. This is good for a wide range of simple, straightforward checks.
The current landscape
Nowadays however, the web and app landscape is complex, and security has rapidly advanced. It used to be the case that abusing inputs in apps (Injection) was the most severe issue. That is something that traditional scanners could easily detect. Nowadays, developers know to take precautions against malicious input, and most popular code libraries are built with security in mind, ensuring that the number of security-relevant bugs is minor.
Currently, the most common type of vulnerability is Broken Access Control (BAC). This is all about defining what the user is allowed to do, and what they are not allowed to do. When the user can do more than what the developer wants to allow, problems arise.
Imagine that you log into your fitness app, which gives you free coupons for smoothies every million steps you take. A BAC vulnerability would be if a user, instead of earning their smoothie through hard work and perseverance, could instead see and steal other users' coupons. Another example is if the fitness app allowed users to pretend they walked a certain path, to reveal the exercise patterns of soldiers in military bases.
The problem is structural
These kinds of vulnerabilities are hard for scanners to detect. A scanner cannot understand what an app is meant to do versus what it is not, and so it cannot alert the developers that certain allowed actions have security implications. A scanner cannot figure out that a core piece of logic allows for abuse, or that certain endpoints are not meant to be reachable by unauthenticated users.
Since scanners lack intelligence, they cannot identify today's complex vulnerabilities; each app is unique, and scanners are largely static.
This is what security audits/penetration tests exist to solve. Intelligent testing understands how an app works, what it is supposed to do. The testers then attempt to find ways to work around any security controls and restrictions, to make the app do things that it is not supposed to. Frequently, a combination of factors come together to form exploits, and each one is unique to the app being tested, so a template or signature would have no chance of alerting you. Worse still, a scanner might bury you under a torrent of irrelevant noise, or make you think that you are secure if it did not identify any critical vulnerabilities.
Attackers have already moved on
Attackers are no longer running simple scans. LLMs gave attackers (more than) an extra hand in their work. Agents can find your app, test it the same way a senior pentester looks, and explore every bit of it for issues. They will see the API key you embedded in the app for testing and forgot to remove it. They will notice that your user data endpoint does not require credentials to access. They will report that a user can send crafted requests to perform admin actions. And whoever is running them might decide to exploit these issues.
The verdict
Scanning is useful to establish a very rudimentary baseline. It is not sufficient to ensure that your app is secure. The cost of a breach is severe; the cost for the attacker to target any given app is falling, as LLMs are rapidly getting both better and cheaper. If you're worried about what a hacker could do to your application, the only real way to find out is to get one on your side to test it.