The root of that is that CVSS scoring is utterly broken, and that even if it wasn't, issues bellow some threshold probably shouldn't be assigned a CVE. And if

The root of that is that CVSS scoring is utterly broken, and that even if it wasn't, issues bellow some threshold probably shouldn't be assigned a CVE. And if open source developers have it bad, people running public bug bounties actually have it worse as financial incentives add to bragging rights...