There needs to be a distinction between 0-days that make remote code execution possible and those that don't. This is still a pretty damning data leak.