I don't think it matters. You have to address it or it just continues to generate noise. People aren't great at predicting what could really be exploitable, so who is going to sign-off on ignoring it at a large company? And there is real risk there - even if only a tiny fraction are truly exploitable in a way that would cause real harm you just don't know which are which.

Personally, I would be absolutely astonished if there were not numerous catastrophic security flaws in LOTS of private codebases in even the best engineering orgs. How discoverable are they without access to the code? Well - how many people have access to that code?

You sound like you’ve already made up your mind. Why would anyone waste their time trying to convince you, random internet stranger? It was just someone sharing their personal experience, which you’ve neglected to do, I might add.