Vendor risk assessment are not part of daily corporate management but it would be. Your current products drive a car or truck and decide to buy you must get something fixed might prove pretty annoying, disgusting, outrageous as well as probably you would never buy that model again and probably wouldn't by from that manufacturer maybe. So why should we accepts buggy software which isn't vulnerable