Seems like obvious solution for issues that CRA and RED causes. Have to fix those vulnerabilities one way or an other. Having a team or making teams using those to fix them when absolutely necessary is something they need. And that that point have to have way to push that stuff upstream so stuff can be marked resolved in tools...

So things do get fixed, but it is not due to their graciousness.