I want to correct multiple inaccuracies in your post.
>They’ve stealth patched a range of vulns without issuing CVEs it appears, or backporting.
This is not accurate, the blog clearly states these fixes are provided in 7.2, 7.4, 7.6 and 8.0.
>They’ve stealth patched a range of vulns without issuing CVEs
Hardly stealthy given I blogged and emailed 300K customers about it. As I stated in the blog, we will be publishing the CVEs on 10th November.
https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products.