I think what's failed to be mentioned is that AutoIt is just a language and compiler. The 'source code' that matters is the executable that's created after compile, because that's what will cause security breaches.
If they want to see the source code for a language and compiler, I wonder what they asked Microsoft before loading any of their software =/