If the upstream software author won’t fix it, and the Debian Maintainer (packager) won’t fix it, and if the Debian Technical Committee chooses not to overrule the Debian Maintainer, then it’s probably not actually a problem.
> if you have configured at least two name servers, or that your time is properly configured, and no false-tickers are present. Things which no upstream vendor even can configure for you.
This, on the other hand, does sound like a nice set of features, but this is then no longer a “Security audit” tool. Ideally, of course, these kinds of checks should be integrated into their respective programs/packages.
> you are the new system administrator and have to deal with the "great" work of the previous one.
Either you know that you can’t trust the previous sysadmin, in which case you have to reinstall anyway, or you start out trusting them, in which case you wait until you actually find something bad, and only then reinstall. I don’t really think this use case is very useful.