A huge amount of time is spent simply mapping advisories to build artifacts which organizations care about and while curating with package taxonomies works, the curation cost scales linearly with the number of taxonomies. Practically speaking data collection will be limited in scope as a result.

However, the cost of curating vuln data with commits is decoupled from the cost of mapping those commits to packages. Mapping isn't free, but here's a demo of how it could work

https://codeberg.org/darakian/provenance-demo