These are serious, but I was guessing remote code execution or sandbox escape. It seems like we're talking about bypassing privacy controls though.
That said, Apple needs to take this much more seriously. They created the program reluctantly and it shows.
> I've reported four 0-day vulnerabilities this year
They're just using 0-day to mean "a new vulnerability finding disclosed to the vendor privately", which is becoming the new definition of the term.
- all contacts, including 3rd party messaging apps, with metadata (interactions, timestamps, other stats) - full address book - whether any app is installed - SSID of connected wifi
- medical info - device usage - screen time - device accessories
I guess I don't consider contacts mission-critical though I definitely would not want them exposed and generally don't give apps access to them.