If the devs indicate that they aren't going to fix it, raising a cve is

- Rude - Counterproductive - not going to result in a fix - not going to help users

If someone does that in the full knowledge that it will cause a DoS on inocent party's build processes and their ability to shift fixes. It could be validly considered a deliberate denial of service via a supply chain attack.

Maybe that should be policy, so these security bods are forced to accept responsibility for the work they cause.

That would look good on their CVs.