The recommendation of "blocking builds/deploys that contain high CVEs" is nonsense. It should be conditional on not having exactly the same CVE in what is already deployed, as it is blocking unrelated fixes.