Undoubtedly, govulncheck is helpful for node operators and app devs who want to ensure their apps are secure. But it doesn't make much sense for CometBFT - a library (even if it's run as a separate binary and ABCI communicates with it via sockets).

govulncheck forces CometBFT to bump the min Go version (MSRV), which applies upstream pressure on app devs and node operators. The argument is that node operators and app devs should themselves watch over Go vulnerabilities and bump the Go version accordingly.