> you don't have to fix CVEs. Goodhart's law is in effect. Large corporates only see that the cve exists and has a large number against it. There is no qualita

> you don't have to fix CVEs. Goodhart's law is in effect. Large corporates only see that the cve exists and has a large number against it. There is no qualitative reading or investigation done. The number is big, therefore you have to fix it... (only helping perpetuate the issue).