Prioritise the review
Knowing that a component deserves attention is useful when that information stays connected to the website and its other security evidence.
Keep conclusions proportional
Component context supports decisions. It is not a claim that the component has been exploited or that an automatic patch has been applied.