I'd still describe the first one as "non-line-item-able" how can you set a lineitem time to "re-jigger the dependencies"? Those take open-ended investigation that no experienced "dev" would commit small amounts of time to like replacing the alternator in a 2003 Ford Ranger.
The second one is clearly an automation issue, are you going to assign a lineitem to "fix the latest rowhammer attack"?
It most certainly does because most software is written atop dynamic systems and every possible change cannot be pre-empted.
Extreme example: RAM writes accidentally flipping bits ala RowHammer. Broken, yes, but is it a bug?