Fixing vulnerability data quality requires fixing the architecture first