If the answer were as simple as “finding defects,” then a fully automated review starts to sound inevitable (and appealing).
But if code review was also how teams shared knowledge, built collective ownership, spread architectural understanding, and taught junior engineers how experienced developers think, then the answer becomes much less obvious.
That’s the mistake I think many organizations are about to make, and the reason we need to rethink what code review is actually for.
I think part of it is what you listed but I also think part of it is to review your update for its architecture or your decision making. For example we had a system which read serial numbers with a barcode scanner. For some reason the original designers decided the user had to scan the sn off the paperwork then off the device then the system does another automated scan off the device. The software verified the first two were identical but accepted anything for the third. After launch we discovered a bug where sometimes the third scan would report the scanners status instead of the serial number. Another developer was assigned to fix the bug. His solution was to filter out anything from the scanner that starts off “status:” this would pass all tests but it’s poor design. In the review it was brought up that it should be verified against the first two, not just that it’s not a status message.
That’s the real value of code review. Not “defects” but inefficient solutions which technically work for the tests.