5 reasons why OWASP Top Ten 2021 is broken

Dear community. Please let me skip any introduction and drop just 5 points straightforwardly.

1. Why “Sensitive Data Exposure” issues are a part of “Cryptographic Failures”?
2. Why Path Traversal is now a part of Broken Access Control but also is directly mentioned as part of A3. Injections (CWE-73).
3. Why “Software and Data Integrity Failures” that focus on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity include “Insecure Deserialization”
4. Why XXE (XML eXternal Entities) is a part of “Security Misconfiguration” for some reason, and not Insecure Deserialization if XML is a data serialization format.
5. 500k data entities were mentioned but only 22k is available on GitHub. Where is the other data?

I also want to refer to the OWASP Top Ten 2021 statistics-based proposal we published in January 2021, 10 months early an official OWASP Top Ten 2021.

Any thoughts?