I agree, I’ve seen a lot of reports where the severity did not match the complexity of the attack or address compensating controls. If you can’t prove that an outside attacker can gain access to the resource you exploited then it should be rated as a recommendation to improve security posture