I don't think it's realistic to expect airline support staff to know how to properly classify and route web vulnerabilities. Giving someone points is just a way to get them to go away so the ticket can be closed.
For that to actually happen support staff has to be empowered to think for themselves and also be compensated enough to care.
Most companies don't give them the training, autonomy, problem solving tools, or even buy-in to deal with something like this.
When I call in I expect them to be able to change my reservation and handle seat changes and such. I don't expect them to be able to triage a tech support call and tell the difference in severity between, say, a shared computer with somebody else's login, a browser caching issue, a database hack, a proxy or CDN issue, etc.