No offense. The widespread of XSS makes it not less harmful. Although attacks with XSS vulnerabilities requires further actions by the attacked users, these are often easily provoked. IMHO a vulnerability shouldn't be rated by its trivialness but by its impact.

Still I think checkpoint is doing clickbaiting, regarding to their description of the vulnerability and Telegrams reply.