Security work has no end, so you need a way to choose. Threat modeling is that choice, written down. You list what is valuable in your app, such as customer data, payment access, and admin accounts. You sketch how data flows through it. Then you ask what could go wrong at each step and how you would notice or stop it.
It does not need special software. A one-page diagram and a list will do. The value is in the questions: can a user see another user's records, what happens if this API key leaks, what if a customer pastes hostile text into our AI feature, who can reach our admin route.
AI coding tools build what you ask for and rarely ask what could be abused, so the thinking has to come from you. Do it when you design a feature, not after launch. Rank the risks by how likely and how damaging they are, fix the top few, write down the ones you accept, and revisit the model whenever you add logins, payments, file uploads, or integrations.