What’s a way to flag to an engineering team that they should do a thorough review of their usage of a particular API because it has footguns in it?

This is a rhetorical question because there isn’t a generally accepted way of doing so. Automatically patch everything is a silly way to do vulnerability management but software is cheap to change, so it’s often easier at scale to just force engineering teams to patch even if it doesn’t make sense in context.

I’m not a fan of this approach, but I can understand why it’s so popular.