These attacks, although theoretically possible, require a lot of assumptions. We want the user to be using an archaic browser, visitor to be user of the site we

These attacks, although theoretically possible, require a lot of assumptions. We want the user to be using an archaic browser, visitor to be user of the site we want to exploit, and visiting a the site we have exploit on.The problem is that if the company dedicated resources to fixing such small issues, which are almost guaranteed to not being exploited, the company is ignoring more important ones which have much wider surface, like an exposed internal tool.