CVEs are good. It means critical issues were found and are being fixed.

No CVEs is the more worrisome of the two.

This is just spunge bob showing up the huge pile of trash all over.

In my 30 years carrier of sw eng there was not a single company i worked for that would take security seriosly enough. Not even the two banks I worked for, the security focus was higher there, but nowhere close to enough. Deadlines had to be met, shareholders had to be made happy. Security is the type of investment the better you do it the more invisible it looks and is easy for managers to put lower on the backlog.

The ocasional security researcher I had the privilidge to talk to or work with always had few vulnerabilities in pocket to report in case they dry up on the findings.

Good luck to the overworked understuffed teams in an average company.