> To me the severity has nothing to do with how popular is a code path, but whether that code path is accessible to an attacker.

That's true for targeted attacks. For untargeted attacks, attackers have little incentive to do the exploit.