>The vast majority of CVEs are not exploitable

Perhaps in isolation. The issue is when you can chain exploits to bypass multiple layers.