The CVE system is far, far from perfect and NIST has faced increasing criticism (even before 2025) about its ability to triage and process the backlog. But I don't think their role is limited to simply posting what’s sent to them?

https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture...

They have nothing to do with the number is my point. They don't uncover anything.