You're dead right about the trust erosion. We saw it happen when we first rolled out a cloud security scanner. Devs started treating every finding like a false positive after a month of "critical" alerts for minified libraries in node_modules.
But I think you're framing the trade-off wrong. The new filter rules aren't harder to maintain than the old linter rules we built. They're *different*, and they're maintained by a different group. Our old linter rules were written by engineers, for engineers, to enforce our own patterns. The new exclusions are written by the security team, for compliance, to satisfy an audit requirement. The toil didn't disappear, it just moved from the platform team's backlog to the security team's quarterly review. Whether that's a win depends entirely on whose time you're accounting for.