In an ideal universe yes. But we live in a world where vulnerability scanners reign supreme.

Yep, I've updated dependencies with an RCE that can't be exploited in my codebase just to keep my security team happy. Not worth the multiple arguments about it not actually being an issue.