Security people always use this crazy risk matrix where if it’s easy to reproduce and affects a lot of people, it becomes high severity even if there is essentially no real world risk. I guess it makes them look better when they can show all the “high” severity issues they found.