Depends on context. When it's a knowledgeable user reporting the issue, you're right.

What I mostly encounter are for profit "security researchers" who try to profit on fear and/or misunderstanding.