Most goalposts I’ve seen say “bad but clumsy”.
Believe it or not in cybersecurity there are many considerations in how “bad” a vulnerability is.
With all that said, how exploit chaining is working these days I think most peoples considerations are not weighted toward bad enough.
Practioners are pretty well settled on how big a deal platform-wide RCE is.