Rapid7 counted twice as many high and critical disclosures, while newly exploited vulnerabilities stayed near 40. The queue is not the risk model.