Critiquing a 'More Agents Is Better' Audit Strategy

A colleague proposes auditing a codebase for SQL injection vulnerabilities by running 20 independent agents, each given the exact same prompt ("scan the codebase for SQL injection risks and report every finding"), and then simply merging all 20 agents' output lists into one combined report with duplicates removed.

1. Explain what this strategy is likely to actually catch better than a single agent doing the same scan once, and what it is not likely to catch better.
2. Redesign the strategy using the fan-out-then-verify pattern from this subject, keeping the total agent count reasonable rather than maximizing it. Be specific about what each phase's agents are asked to do differently from the others.
3. A stakeholder asks: "why not just run 40 agents instead of 20 to be even more thorough?" Give a substantive answer grounded in the subject's discussion of cost and diminishing returns, not just "it costs more."