Patchstack openly admit that they don't do basic due diligence with vulnerability reports. So often, at best, vulnerabilities are only partially fixed.

They are also trying to get reports redirected away from developers to themselves. So you have an unreliable middle-man in the process as well.