Kind of silly. None of this measures the stuff that matters in the current context .
Checklists are nice, but they do not solve all problems
They need an "Extreme Resilience" check where the maintainer hires a red team of elite security analysts that work full time to try and breach the project. Projects get 1 point for each full time security analyst that worked on this red team over the last 12 months up to a maximum score of 10 points (10 or more security analysts). But score drops to 0 points if the red team succeeded in breaching the project during the last 12 months.
0 known vulnerabilities says everything I need to know about the efficacy of this site.
Is it a vulnerability if it works exactly as intended?
Yes. That's why it has a CVE with a score of 10.
/s.
Perhaps it's because it's not up to date? As the page says: