Part of the problem is, vulnerability scans are the only tool for vulnerability management that our puny tiny pathetic programmer brains have invented. Now, realistically, it would make a lot more sense if libraries that call pickle() had some kind of "use warning" attached to them, which your IDE would use to detect when you do something that opens you up to compromise (such as using untrusted user data in some weird contrived context that forces a library to call pickle() on it). But NO. You CANNOT have this. Everything MUST be a CVE.