and why is it not on the vendor of the critical application?

Because they aren't allowed on the system where it is installed, and also they don't deal with hardened systems.