Yeah, they are frequently just parroting things like CVE notices as highlighted by a fairly stupid scanning tool.

The security ecosystem has been long diluted because no one wants to doubt a “security” person and be wrong, and over time that has made a pretty soft context for people to get credibility as a security person.