I'm not a security researcher, but I've heard your point made in a couple of places, and I've come to agree with it. If you're going to boil everything down to

I'm not a security researcher, but I've heard your point made in a couple of places, and I've come to agree with it. If you're going to boil everything down to a single, approximated number, you might as well make it obvious that you're approximating. Having scores like 5.8 makes people put more trust than is appropriate into the algorithm.