Note that Apple doesn't discuss vulnerabilities until after they are patched. Will unpatched ones even show up there?

so you are disgusted by something that may or may not exist?

CVE is public and collects both patched and unpatched known vulnerabilities reported by vendors and independent parties.