what’s the difference between the issue not being reported and the issue not being fixed because it’s not seen as a priority

Triaging and investigation take time. Plus having a bunch of open security issues even if they’re not critical destroys public confidence in the software