In addition for false positives there is also the issue of false sense of security. Just because the scanner said that a code is valid doesn't mean it is secure.
For example any code that doesn't strip tags from input in multisite environment is insecure, but I don't think there is any way to automatically detect that.
Different example, I doubt that an automatic tool could have discovered that W3CT and supercache expose private/security info to the public net.

I think that you have to assume that all plugins are insecure untill you audit them. There might be even a situation in which some plugins are declared secure but a combination of them is insecure