To my knowledge, there are also critical exploits that simply have no mitigation. Thunderspy was disclosed to Apple nearly 5 years ago and there is still no credible solution to the threat it presented.