I think all this goes to the joke/not-a-joke about "you aren't a real hacker until you have a CVE to your name". Its also a form of forced social proof.