One Missed Threat Per Week: What 25M Alerts Reveal About Low-Severity Risk