For sure. I've worked at orgs where we disabled package vulnerability scanners because they created a constant stream of upgrading busywork. So many "vulnerabilities" are things like "JavaScript prototype pollution in this package that does something in your build toolchain". So much noise and so very little signal, the incentives of these scanning and vuln tracking companies just aren't aligned well I don't think.

Nowadays I tend to more rely on tech news to hear when there's an actual serious vuln I need to address.

(Note I'm not advocating everyone do this. Do your own risk assessment).