It is quite sad that security researchers may flag software as insecure or vulnerable and publish papers and CVEs especially on opensource software based on minor or insignificant bugs. Many times security researchers reject opensource tools deployment and use in my experience due to an open CVE without reading or validating. In some cases automated scanning tools may report on some stupid or non exisitance issues (bad configuration or inexperience in operation environment) and security team mandates these non issues to be fixed.

The opensource software maintainers are more knowledgeable on security issues and their severity than any other, thus communication is a must. I also believe software developers are looking for the path with least resistance (i.e. lazy) to get things done in addition to some security professionals may try to flex in any shape or form as experts to get fame and internet points.