Yeah, agreed -- (1) isn't exactly commonplace. That point was originally meant to fit into an extended section of the post on reporting format imprecision, i.e.

Yeah, agreed -- (1) isn't exactly commonplace. That point was originally meant to fit into an extended section of the post on reporting format imprecision, i.e. our current inability to express anything more precise than "this dependency is exploitable, you need to upgrade it" with existing vulnerability formats and feeds. Not being able to automatically filter by implementation variance or context-sensitivity fall under that. But I then trimmed that section so this point is mostly irrelevant to the larger post, as you said!