Nice analysis, but I have an issue with the raw data, especially the change in meaning of the Access Vector.
In CVSS v3, a "Network" access vector is reserved for "network stack bound vulnerabilities", and not anymore for malicious files or website based exploits. See for example https://www.first.org/cvss/examples#i16

Unfortunately, it seems that NVD is still using "Network" when it should actually use "Local", inflating the score artificially. If it would follow the definition exactly, it actually leads to a decrease in score...

Would you have time to review your statistics and correct that bias? How does NVD stand about this definition/interpretation issue?