It seems like there is no way to write the output in a chosen format to a file/env

The docker scout cves command supports the following --formats

--format string               Output format of the generated vulnerability report:
                                    - packages: default output, plain text with vulnerabilities grouped by packages
                                    - sarif: json Sarif output
                                    - spdx: json SPDX output
                                    - gitlab: json GitLab output
                                    - markdown: markdown output (including some html tags like collapsible sections)
                                    - sbom: json SBOM output

I believe many would like to choose their format and then write it to a file or the action env such that it can be used in later steps.
There does not seem to be any way to pass the output to following steps apart from the sarif-file option, which is not a very nice option if you want to do your own stuff.

Start with the docker scout cves entry point and its --format and sarif-file handling. Check how the action currently exposes command output and GitHub Actions environment values. Done means a caller can select a supported format, write the result to a file or action environment, and use it in later steps.