Another thing is I think one can analyze binaries (decompiled or not) to extract control structures in machine code or byte code to control flow graphs. Using some classical pattern matching, that should not be too difficult because the number of ways compilers transform code like loops are limited. Allowing some degree of fuzziness, I'd often expect these to be very characteristic for the original source of a code piece. That source might often be FOSS code; often an old, vendored version not updated in years.

One could then use standard graph search/fuzzy matching algorithms and graph databases in order to find out which GPL’d open-source code e.g. some proprietary product has included. This would give away potentially vulnerable versions. And it would not necessarily need a lot of computing resources.