Someone's currently going through old questions (typically ones at least a year old) and flagging the ones requesting tools for closure. Is this an appropriate thing to do?
Guilty, so here are my thoughts.
Let's keep this in mind: so far, every single flag I've raised has been labeled as "helpful" which means that these questions were indeed off-topic.
Why not just leave these questions alone?
We have a review queue about this and it's called "Late Answers". For example, so far today there were 3 late answers which means that eventually, someone will post in one of them (them being the off-topic questions) when the question itself should be closed in the first place.
Neal suggested to edit these questions and to be fair, most of them seem irrecuperable because they are blatantly requesting for X product doing Y. Also, like I said in the comments, it would also bring them up in the feed, which is what we probably want to avoid.
Is there a written rule against this?
As far as I know, nope (feel free to correct me if I'm wrong).
Also, what also makes me believe that this is not wrong is that we can a maximum of up to 100 flags per day! Therefore, I do not see why one should be refrained from flagging many questions in a somewhat short length of time.
Now about flagging old questions, if this is inappropriate, why are we able to do so then? Simply because it does not mean that it's a good and/or appropriate question because it never got flagged.
There has to be something negative this could cause, right Mr. Simon?
Sure, it fills up the queue with questions that don't need immediate care. Therefore, if you flag a bunch of questions, a newer question might not be reviewed because the reviewers maxed out their review cap (I feel like I should stop typing "review"). That, indeed, can cause trouble.
What should be the proper behavior?
Well, as suggested by the almighty @AviD in the chat, flagging a few questions at a time to avoid filling up the queue is probably the best way to act. Personally, I'm still unsure if we should edit these questions at all considering that most of them seem to be a lost cause.
The presence of a reasonably successful site like https://softwarerecs.stackexchange.com/ demonstrates that software recommendations can be handled effectively in the stackexchange format. But for a field as specialized and often counter-intuitive as security, I think keeping the questions here is typically a benefit.
It is often harmful to close, and not delete, old questions which already have helpful answers. We would typically be left with questions which over time will have bad answers, because new and improved tools will come along. Deleting them is often even more unhelpful, as a waste of admin energy, a source of needless debate, and a loss of useful information.
The appropriate action is to improve the question with edits which demonstrate best practice, by making sure it is clear just what the requirements are for the tool, so that there is a good answer. When there is a good accepted answer, such edits should typically make it so that the question matches the answer.
It is also bad form to suddenly flag lots of questions, before discussing goals and strategies with the community.