Sure, some high severity RCEs turn out to be quite hard to exploit in practice, but others show up an hour after disclosure as a python script that fits into a tweet. No one is willing to bet their job on guessing which it will be, so you have to patch anyway. Pointing out scams in security research is valuable but maybe not when everyone is already exhausted and miserable.