I assume the dev number is higher because the version bump is mixed in with other changes and discovering the CVE in the new version means investigating compati

I assume the dev number is higher because the version bump is mixed in with other changes and discovering the CVE in the new version means investigating compatibility with the feature work you just did. Agree that you have to be skeptical about studies like this.