You cannot have a government with a high interest and stake in national security without bringing up all of those 16 identified "critical infrastructure sectors

You cannot have a government with a high interest and stake in national security without bringing up all of those 16 identified "critical infrastructure sectors" with you. CVEs are almost a starting point of truth. The threats can be verified, tested against/for, etc. They're also tied up in insurance liabilities. If there are no CVEs, there will be no cyber security insurance. Follow the rabbit hole.