There’s a whole industry of bug bounty hunters making money off this trivial stuff. At work I had to fix a “bug” which could only be exploited if an attacker took control of facebook first, and even then it just meant a user could be redirected to a different website. And the company paid the clown that found the “vulnerability”.