Poettering is dismissive of nearly every bug. Remember when systemd would default to starting units as root when it couldn't parse the username? We're not talking about some minor piece of software like a sound multiplexing daemon, we're talking about the core userland piece of every Linux install. Bug reports on something that central should be taken seriously and with a minimum of snark.
I'm with Poettering on the specifics here: if we filed a CVE for every theoretically-exploitable-but-unexploited-until-fix-released crash bug the system would be beyond useless.
All the more reason to reduce the attack vectors and ensure that your code is well thought out, and coded defensively. That you have too many security issues to generate CVEs for each and every one is a problem in and of itself. Ten years ago how many people thought that all of these speculative execution side channel attacks were possible or practical?
(Also... gotta be honest that's sort of a vanity CVE. Note the complete lack of details in the report itself, it never saw an eyeball after it was filed. It's valid enough, but frankly I'm with Poettering on the specifics here: if we filed a CVE for every theoretically-exploitable-but-unexploited-until-fix-released crash bug the system would be beyond useless.)