no. i am saying that this is actually a problem. especially for companies that need to implement certification like fedramp, which is very strict in areas of vulnerability management/keeping things updated/secured/hardened per specifications. (each individual cve vulnerability must be detected and remediated within specific timelines, based on it's severity)

i am currently working on fedramp certification for a big system, and all requirements are serious pain in the ass to comply with, in case your organization not used to it