Components with Known Vulnerabilities

Some own outdated version of apps

• already have their own well documented bugs and exploits

For instance,
Company hasn't updated wordpress for years
-> You use wpscan to find its version 4.6
-> Wordpress 4.6 is vulnerable to RCE Exploit
-> There's already a public downloadable exploit in here https://www.exploit-db.com/exploits/41962

Meaning, version number and software name aren't explicitly public.
Note: https://www.exploit-db.com is incredibly useful, and for all you beginners you're gonna be using this a lot so it's best to get comfortable with it.

Most public scripts only tells you what arguments you need to provide
Exploit devs rarely make you read hundreds of lines of codes just to figure out how to read the script