I don't think there's as much survivorship bias as you're suggesting - we do, in fact, have the airplane wreckage to inspect, it is just that frequently after-a

I don't think there's as much survivorship bias as you're suggesting - we do, in fact, have the airplane wreckage to inspect, it is just that frequently after-action forensices doesn't happen. But the point is valid. I think lists like these are primarily useful for evaluating how unfamiliar networks are managed - if you spot anything on the list, likely some bot or volunteer-sysadmin already beat you to it. And if your scanner doesn't know to look for something on the list, it is probably time to renew your support contract or find a new tool.