> Basically CVEs are often weaponized in a really counterproductive way.

This is inevitable when you boil everything down to a number. When that number refers to a (potentially) costly bug, people shirk critical thinking and just go straight for zero-tolerance.

Not ideal but I'm not sure if there's a better way :/