We had a bug bounty program manager who didn’t screen reports before sending them to each team as urgent tickets.

80% of the tickets were exactly like you said: “If the attacker could get X, then they can also do Y” where “getting X” was often equivalent to getting root on the system. Getting root was left as an exercise to the reader.