> "out of bounds read = bad" even though realistically you can't do anything bad with it.

I have absolutely seen more than enough exploits for "obviously unexploitable" vulnerabilties that I think the "out of bounds read = bad" mindset is the only reasonable mindset to have.