With some Yocto magic, we can reduce the number of unpatched CVEs in a Linux image by 50-70% and the number of unpatched kernel CVEs by 60-90%. Addressing and remediating vulnerabilities as mandated by the CRA becomes a lot more manageable.
Fixing 1000+ CVEs one by one is too costly. Filtering them is arbitrary and might miss important ones. Making the exploitation of hundreds of CVEs unlikely by multiple security measures in one go is nothing else but defence in depth!
Instead of fixing hundreds of CVEs, manufacturers can provide enough security measures to make the exploitation unlikely. The decrease of the CVSS metrics is a useful indicator how effective the security measures are. This post is about understanding the CVSS metrics.