Does "we have 4,000 open vulnerabilities", or "findings fell 30%", tell you how exposed an organisation is?
US federal rules, FedRAMP and scanner dashboards all use counts of findings, and the bodies writing those rules say in the same documents that counts depend on how hard you look. NIST calls counting all vulnerabilities "not actionable" and says monthly or unauthenticated scanning undercounts. Research since 2005 agrees, and the core problem is that nobody records the effort, so it can't be separated from the number. Most known vulnerabilities are never seen exploited at all, with studies putting the share somewhere between about 1% and 15% depending on who's watching.
Finding data does carry some signal, and I don't want to overstate the case. An insurer found that a single unfixed critical flaw, end-of-life software, or exposed devices from one firewall vendor each went with more claims. A broker reports that aiming to patch high-severity flaws within a week halves the chance of a cyber event. Slow patching and visible misconfigurations go with more incidents, one small study found a count of policy breaches predicted intrusions after allowing for size, and the US cyber agency treats falling counts from its own unchanged scanning as progress, which is a fair use of a count.
So nobody can answer the headline question yet: I found no study testing raw counts against incidents with size and scanning effort controlled. What I think is defensible is narrower. A count compared across different scanning, scope or size says very little. A count from an unchanged set-up, tracked over time, says something. And how long serious findings stay open is better supported than how many there are. None of which means finding and fixing vulnerabilities is pointless; the evidence points firmly the other way.