Not every vulnerability is fixable inside a release window. Sometimes the fix is in a transitive dependency with no patched version. Sometimes the risk genuinely does not apply to how the component is used.
If the pipeline offers only pass or fail, the pressure to ship converts into suppression: a threshold quietly raised, a scanner argument added, a check disabled "temporarily".
Give acceptance an explicit path that records who accepted what and why, and the same decision becomes reviewable. The finding is still there, still visible, still counted. What changed is that the pipeline stopped forcing people to hide it.