Yes, recently we got a security “finding” from a security researcher.

His vulnerability required first for someone to remove or comment out calls to sanitize data and then said we had a vulnerability due to lack of sanitation…

Throughout my career, most security findings are like this, useless or even a bit deceitful. Some are really important, but most are garbage.