Code review

Human review catches the things tools cannot express as a rule: intent, context, and whether the design makes sense at all.

A scanner can tell you this query is built by concatenation. Only a person can tell you this feature should not exist, or that the check is in the wrong place, or that the author has misunderstood what the function is for. They find different classes of problem, which is why one does not replace the other.