A quick look at the list of CVEs in the grandparent comment indicates that there are at least 3 different Assigning CNAs for systemd CVEs: MITRE Corporation, Red Hat, Inc. and Canonical Ltd.
My conclusion is that the systemd project is not its own CNA and therefore not in a position to authoritatively decide which systemd bugs get CVE numbers assigned and which do not.
My conclusion is that the systemd project is not its own CNA and therefore not in a position to authoritatively decide which systemd bugs get CVE numbers assigned and which do not.