Also, there are (or were) organizations that give their programmers incentives for finding and filing CVEs. Naturally that's lead to lots of low-quality CVEs, and with AI and other automated tools it's become easy for low-information programmers to generate reports on code they have zero understanding of.