That may be true, but we're talking about core library vulnerabilities that major projects use, not one-off's that nobody else cares about.