The bad guys wouldn't have submitted a vuln report anyway.

Actually, submitting hundreds of bogus/low impact AI generated ones while you sit on something big might be a viable strategy to delay a project from fixing a hole you're using