I don't understand this. By that logic you could go from HTTP to a new but buggy and flawed HTTPS (when that was in its infancy) and rather than that being considered a vulnerability, you could say "Well, everyone else is just using HTTP so they deserve a CVE too..."