Sure, but this is more akin to dismissing a 1click RCE as “social engineering” because an employee has to be convinced to click a link.