Yup, but in a roundabout way.

For example, they'll inspect traffic and nab a session cookie. Then they'll use that session cookie on another internal API request to change a setting, and claim they were able to modify a setting by reverse engineering things.

They seem really scary at first, and then you dig into it and you're like "oh...".

I'd say that >90% of "security incidents" that I've seen reported are completely bogus. And we don't even have a bug bounty program. They will still beg for free stuff like t-shirts and other tiddletat.

I think the majority is just ignorance rather than malice though.

A few weeks ago I saw a vulnerability reported for an FTP server that claimed they could put a file on the remote server. With FTP! What madness! I wish I could find it but I cannot, still makes me chuckle.

Yeah, we get those too. We let people write JavaScript to build their sites (we're a site builder), and people will use that feature and add an alert and then claim it's XSS (on their own account).