The gold standard deep and certain vulnerability remediation requires A/B test exploit sample code.

You're really going off into the weeds about other concerns rather than covering and ensuring known flaws don't exist than can be checked automatically and mechanically given proper infrastructure that don't need significant or constant human attention. There is a place for human attention, but it isn't going to scale to check 10 million machines.