So a so-called vulnerability has:

- cited code not exist, and

- PoC not work.

How would any serious system allow it become a big deal?

Exactly. CVEs shouldn't be allowed to be anywhere near critical without a working PoC or other proof.. Trust+verify.