If a vulnerable library is in my app but that code path never runs, will CVE Shield flag it?

No, and that's expected. CVE Shield reports on code that actually executes, not everything sitting in your dependency tree. That's the difference between "reachable," meaning the library is present in your code, and "reached," meaning the vulnerable path actually ran. If it never runs, there's nothing exposed to report. This is also why CVE Shield can run continuously in production without a performance hit. It's not doing a heavy static scan up front, it's observing real execution as your app takes traffic, so coverage builds automatically.

See: What's the difference between CVE Shield and a static scanner?