Expired and still open is a risk acceptance nobody renewed and nobody fixed.
Never scanned is a gap. Not applicable is honest — a mainframe has no containers.
In the CMDB, and absent from every scanner that applies to them. Only the join can see this.
The recorded owner has left, or there never was one. Here that is also an access-control problem: an owner's scope comes from this record.