Vuxml URLs

I run `pkg audit -F` daily from periodic; not the stock script for
this purpose but my own close adaptation. I can post the whole script
but it should not be necessary for this discussion.

Lately I found that the reference URL given for each newly found
vulnerability is almost never operative. Example today:

...

expat-2.7.5 is vulnerable:
  Vulnerability found in Expat
  CVE: CVE-2026-45186
  WWW: https://vuxml.FreeBSD.org/freebsd/bacc1417-4d82-11f1-87f3-18dbf25a98c6.html

and browsing to the URL just gives me a "404".

I don't understand this. I could understand if there was a delay
between finding the vulnerability and putting the webpage up; but in
that case, would it not be better to not include the URL at all until
it is actually good to access?

-- 
Ian