I'll try and get to as many aspects of your various questions as possible, but I think the first thing to try and clear up, is that osquery isn't primarily a vulnerability management tool. It can be used for vuln management, but that's more reliant on the types of questions your asking