Well not pinning does not lead to everything that uses the vulnerable dependency to magically rebuild, just to make the builds less deterministic. The solution

Well not pinning does not lead to everything that uses the vulnerable dependency to magically rebuild, just to make the builds less deterministic. The solution is not to blame pinning but to use tooling that informs about the vulnerable dependencies.