8.7.1 is the section on Control of Nonconforming Outputs (NC), but that is for the purpose of “preventing their unintended use or delivery.” Yet, your question indicates the problem you see is no action on NC product, years after being identified as NC.
It is clear the production process has created NC product, as evidenced by NC records you mentioned. How can the organization be confident they captured and contained ALL of the NC product ever created, and no NC product was inadvertently used or escaped? At a minimum, a proper investigation would give assurance how effective their inspection methods are in detecting and containing such NC product. More directly, what has the organization done to investigate the cause of the NC product and reduce or prevent recurrence?
If this is also your concern, refer to section 10.2 to write an audit finding. AS9100 section 10.2.1 goes beyond ISO9001 and requires “documented information that defines the nonconformity and corrective action management processes”. If years have passed with no records answering these questions, they are lacking documented evidence their 10.2.1 records are adequate and their 10.2.2 actions are effective.