Nice way to think about it.

I guess it really depends on the severity of the defect. Would it allow some really significant exploit? -> Important to fix.

Does the defect only prohibit one very esoteric use-case which basically never comes up (and was thus never reported by a human user and only now that we have an infinitely patient machine checking every completely unlikely code path is it detected) -> more productive use of your time to develop a new feature which would be used by more people.