Also the vulnerabiolity scanner is still broken and showing old vulnerabilities that don't exist anymore

right, if osquery is still reporting that package as installed, fleet hasn't changed