Sure, but sometimes they're not. Those sometimes can be very, very critical. Think of the Red Hat (and others) local privilege escalation, for example: Red Hat

Sure, but sometimes they're not. Those sometimes can be very, very critical. Think of the Red Hat (and others) local privilege escalation, for example: Red Hat released a CVE with vague language and with no clear steps to take. If you ran a server that had lots of users, some of whom might be mischievous, you'd be pissed, because you'd be wondering what the heck to do before one of your mischievous users did something.