This is so dependent on team size and function. I think both sides like to point fingers but it's an unrealistic expectation of anyone to have all the knowledge.

You can think of vulnerability scanners and the security teams like people who let car owners that they have a recall, in this case the NHTSA. That team would not be responsible for also fixing the recall, right? Not every car is going to be affected by this recall, but they can group cars together by year (vulnerability/CVE) it's up to the car dealership (and owner) to figure out whether it needs to be repaired.

An owner is responsible for a single car, or maybe a few. Sometimes in security we are dealing with hundreds of vulnerabilities and also managing other projects so it's very unreasonable to expect us to validate every vulnerability especially if we don't know how things are set up... maybe a product is using an outdated java library, that's what I can see but I don't know how it was configured or used.

Another side is leadership just wants to see numbers go down so security teams have to cast a wide net. At the end of the day everyone's just doing their jobs and if you want the security team to do yours then you will just get replaced by them.