Tesla not only looks at these, they coordinate their fixes and disclosure. Tesla runs a bug bounty program https://bugcrowd.com/tesla, contracts with security research companies to audit its vehicles, has a security researcher program where they share more access & documentation for researchers who have helped improve vehicle security, and put up both vehicles and cash in pwn2own.

Obtaining code execution, persistence, or privilege escalation on a Tesla is a formidable challenge. Pwn2own went many years without there being any compromise of the vehicle, and last year's compromise was done by a firm that dedicated a lab and team of people for more than 6 months.

CVEs are the very basics of published security vulnerabilities. Any company that makes software with at least one person who claims to do security will very likely be paying attention to these; Tesla is more than that, so they're going to be doing a lot more.

That said, neither CVSS scores, security researchers, nor security teams are perfect. Some reports will be marked as won't fix, some teams won't publish vulnerabilities as CVEs, and some CVEs will be wildly inaccurate. But yes; they're going to pay attention to them.

At least two of them are marked as "DISPUTED", so presumably yes, Tesla does respond to them.