If you scan per quarter, and it takes you n days or weeks (or months) to fix the critical stuff, it’s quite a window of exposure - per each vuln. Any midsize org will carry hundreds or thousands. Enterprises much more.
a real one? someone was trolling with a fake one https://blog.zsec.uk/cve-2020-1350-research/
It’s partially the security industry’s fault for promoting ineffective and expensive methods as the go-to.
When I was doing IOT power/temperature monitoring sometimes companies wanted us to show PCI compliance before attaching our hardware to their networks. (we weren't) which meant we had to explain to them to put us on a separate network, without credit card processing devices.
Unfortunately the security industry somewhat predictably responded with snake oil and bullshit that were predictably countered with overpriced Big N assessments, but that's another story.