Well, personally when I ask about something with an acronym is just for shortness, but of course if you see the candidate a bit worried unable to give an answer for that specifically then I usually try to help saying something on the lines of (in this specific case), "So if I say XSS or session hijacking does anything comes to mind?" So like I don't just ask about OWASP and then move on, try to help, so I am pretty sure that it was not just the list, but yeah also I made an example of the one we hired, but I've had candidates knowing a lot of stuff but not knowing what a decorator was, so I was making a point more specifically about concrete frameworks versus principles