No I know it's on par I guess better rephrasing would be the par is still too low
Compared to what? What's your baseline for how much a user-interaction-required XSS vulnerability should be worth?
Compared to what? What's your baseline for how much a user-interaction-required XSS vulnerability should be worth?