CVEs have been questionable for awhile as I have seen quite a few over the years that amount to "the attacker already has root on the machine".

The problem now, is we are entering a phase of the general IT market due to government mandates and insurers for all kinds of cybersecurity junkware. Following a CVE database and pushing scary CVEs are basically the end result and the overreaction will still be the same as many of the cybersecurity positions are no different than checklist readers since companies don't want to pay for actual engineers or skilled sysadmins.