I count security fixes with "bugs that you would hit in your use case".

I don't care about CVEs that only affect functions my app do not use.