You haven't seen Seinfeld? Wow, you aren't American, are you.
Look it up on YouTube if you don't believe me.
He didn't.
He got people like the owner of Oracle, TikTok owner Binance, and others to foot some of the bill.
The scores do fail though - they don't encompass enough information. They can't encompass enough information because something that is critical in one sense (e.g., and making shit up here, Java listening to the internet) might not be in another (e.g. Java running on specific scientific data in an airgapped environment). Security is always situation and risk-appetite dependent. No number can encompass all that.
It's hilarious the parallels between their ignoring of this bird flu epidemic and the COVID pandemic.