That’s not true; the only way to be found guilty following a CRA is to conceal the active exploitation of a vulnerability, fail to alert the national coordinator, fail to propose a mitigation within a reasonable timeframe, or be openly negligent in the management of the cybersecurity of one’s products.

“Please stop using this version of my product or this particular feature; it is vulnerable” is an acceptable mitigation measure.

A CVE isn't an active exploitation and don't trigger anything.