[Brian_K_White]

Tell me how they matter.

They don't. If some code is so old or un-used that you would call it "dead" then there are no cve's on it. No one is using it to discover a vulerability, no one is studying it to find a vulnerability, who writes these supposed cves?

Even if by some miraculous combination of unlikely contrived coincidenses, someone researches, discoveres, writes up, and submits a cve, and the tracking orgs accept and publish it, so what? You just called it "dead" so who does it affect? What does this "cve" matter?

If they do matter because there are users, then it's not "dead".

It's just code that exists that may or may not be useful or interesting to someone sometime for something, or not, like a novel or song or painting.

If it's half-baked code with some problem if it were used exactly as it sits with no further work, so what?