Semgrep's rule syntax is closer to writing an example of the bad code than to writing a query. That lowers the barrier enough that application engineers, not just the security team, can add rules — which is the main reason custom rulesets tend to survive past the person who created them.
Where custom rules stop helping
Every rule encodes something you already suspected. That makes them excellent for enforcing decisions your team has made: a banned function, an internal API used the wrong way, a pattern you've been burned by before. It does nothing for the class of bug where the vulnerability is the absence of a check rather than the presence of a bad one.