A finding is a beginning, not an end

Reporting a problem creates work. Someone has to understand the finding, decide it is real, work out the correct change, write it, get it reviewed, and ship it.

Most security tools stop at step one and call the rest someone else's job. That is why so many teams have long lists of known findings and no time.