You know, it seems like ever since the Heartbleed debacle we can get a rough sense of how complex a vulnerability is by examining how much explanatory text or context on normal system operation is required to explain it to a layman. “I asked it to make me an admin and it just… did it” might be the literal minimum level of complexity by that standard.