In my experience, it seems like vendor disclosures, and measures that might impact correcting vulnerable components are insufficient, and slow, if they happen at all.
The larger brands are getting pretty good about disclosing in a timely manner but you always have cost cutting happening unbenowst to you organizationally where inventory as you said isn't accounted for, and then those devices may or may not have disclosed vulnerabilities or had a fix within a reasonable time after public disclosure. Not vetted hardware but consumer, or semi-professonal brands that are much smaller.
I've run into areas where mitigations also were extremely costly because some simple circumstance was overlooked.
As an example, almost 8 years ago I was brought in to help a client who had suffered a ransomware attack where their previous IT staff were non-responsive and they were desperate.
They had Mcafee's DLP deployed organization wide, and the local DLP server that generated the unlock codes was among several other assets that had been encrypted but not documented or inventoried (so that didn't have a backup). The software product true to their word prevented even authorized system administrators from being able to make any mitigative changes without that unlock code which was not possible, their support for resolution was ineffective and useless. Even in safe mode, everything was locked down, and after exhausting all other options even accessing the system physically from a Linux live disk failed, the HDD would hang after trying to access certain parts of the disk (at an extremely low level). We were never able to figure out exactly what caused the hangs, but it happened regularly for long-running processes and we verified SMART passed. We had a guess that they were doing something funky with NTFS where separate files under a certain size get conglomerated into the same sector block which wasn't supported by Linux at the time, but we were never able to confirm definitively.
What could have been a few hour turnaround ended up turning into a week of downtime (where everyone was shut down, 10 days). Fortunately it was during the holidays which was their slowest time when they normally shut down for a week but it could have been much worse.
After exhausting options, we ended up having migrate data, wipe and reimage with almost a completely new infrastructure. We corrected a number of additional issues (misconfigurations) we found during the process but there was a good portion of time where we were just spinning our wheels with the vendor who was useless.
We went to contingency and stood up new infrastructure after we hit a certain threshold on man hours trying to work with them without any progress.