HttpOnly doesn't make sense for most apps anymore, because so much of the logic in modern web apps happens on the client side in Javascript.

The takeaway I'd suggest instead is that when one gets a pen test report back with a bunch of lower-severity issues, fix them instead of deciding that anything "medium" or below gets put on the backlog, because frequently a bunch of lower-severity vulns can be chained together like this to yield something much more dangerous.