I don't want to make RH the good guy in any of this, but I'm not sure why this is surprising. In my corporate, regulated environment (and most other places I'v

I don't want to make RH the good guy in any of this, but I'm not sure why this is surprising. In my corporate, regulated environment (and most other places I've worked) the dev teams have virtually all said "we aren't going to commit to fix medium and low vulns on any particular schedule unless there's an overriding business reason to do so (fixes a customer visible bug, regulators start demanding it, we get hacked because of it, etc)". Usually, this is couched in terms of 'resource constraints' or similar. I'm sure similar issues confront RH, and they are applying similar reasoning, right or wrong.