Large Language Models (LLMs) for code are increasingly used for software vulnerability detection, yet security review requires more than a correct Vulnerable or Safe label. Analysts also need to know whether a decision remains reliable when code is rewritten and whether the evidence behind that decision remains stable. Existing studies often examine classification accuracy, rewrite robustness, and explanation quality as separate problems, leaving unclear how prediction and explanation behave under the same controlled setting. This paper presents From Prediction to Understanding, a robustness and explainability study of vulnerability detection with LLMs. We evaluate six code language models across encoder decoder and decoder only architectures, C/C++ and Java, and multiple parameter scales under a shared direct classification prompt. We then construct Surface level and Structure level rewrite stacks and assess black box and white box Explainable Artificial Intelligence (XAI) methods on the same rewritten inputs. The results show that CodeT5+ is the strongest detector, reaching 0.87 F1 on C/C++ and 0.94 F1 on Java, and also provides the highest correctness under rewrites. However, prediction strength does not imply explanation stability. PLBART gives more stable attribution evidence in representative XAI settings, reaching 0.934 top-K stability under low rewrite rates despite lower classification performance. These findings show that vulnerability detectors based on LLMs should be evaluated as both prediction systems and explanation-bearing systems before being used in security triage.