if open source is struggling with this volume, what is the likelihood that if commercial software would also struggle if they were scanned and exposed?

I mean Microsoft, 2026 Sept Patch Tuesday: 964 CVEs...