Some reduction might not be so bad. I would love to know how many times I've said the phrase "the version string/CVE is irrelevant because our vendor backports patches"

A lot of this can/should be boiled down to: are our updates and mirrors current?

One selects an OS vendor/distribution explicitly to make this kind of thing their ~problem~ responsibility. They gave me "foo", they can fix it.

There's usually no problem because nobody builds everything from upstream sources. The security vendor yells at me and the OS vendor about discoveries in something they never packaged.

Each distribution gets sufficiently involved that I refuse to mind most CVEs. Eternally grateful my current role allows me to drop this charade