One reason AI companies are so eager to report FOSS vulnerabilities is that doing so creates the perception of need. Doesn't matter if they're mostly low-risk or low-priority. Doesn't matter that they were mostly discovered by actual cybersecurity researchers. The perception of need is the point. Volume serves that aim. Dropping 50 reports on a project makes people to think, "Wow, we're cooked without AI." That many reports at once overwhelms the maintainers? Guess they need AI to keep up.