What are you talking about? TempleOS isn’t a punishment, it’s a reward

If you wanted to truly punish them, install Debian Stable

It’s for people who always work in front of a film crew so the camera can see their faces

If you can’t demonstrate an attack they will assume the issue isn’t exploitable.

Absolutely. Theory doesn’t always equal reality. The security guys submitting CVE’s to pad their resumes should absolutely be required to submit a working exploit. If they can’t then they’re just making needless noise