Most goalposts I’ve seen say “bad but clumsy”.

Believe it or not in cybersecurity there are many considerations in how “bad” a vulnerability is.

Practioners are pretty well settled on how big a deal platform-wide RCE is.

With all that said, how exploit chaining is working these days I think most peoples considerations are not weighted toward bad enough.