I'm on the fence over the "marketing". On one hand it is easier to communicate terms like DROWN, GHOST and Heartbleed than say CVE-2016-0800; meaning knowledge of the vulnerability gets spreads quicker and sites are patched more readily. Alternatively it could be a distraction from good security management practices, where only the "marketed" vulnerabilities get patched instead of general tracking the security of critical pieces of your infrastructure.