Thanks, this seems to confirm my train of thought. To lose coverage the attack had to exploit that particular vulnerability and a patch had to have been available for over 3 weeks. A false CVE can't be exploited so you can't lose coverage by not patching it (even if a purported patch existed).
