To be fair, it is possible for a command to obfuscate it's own command line (I've seen this in `ps auwx` but can't offhand recall which command was doing it).

But in no way is that high - CVE ratings have turned to useless junk quite rapidly, probably sometime around when it became monetizable.