It's not a vulnerability, but it's an exploit. Most vulnerabilities in the wild never have an exploit written, because we mostly assume that for example arbitrary write or buffer overflow are dangerous and "can lead to arbitrary code execution", but actually exploiting them is hard.

This is someone who spend some time to write something to actually exploit sites with this vulnerability.

Yes, but that doesn't mean defense-in-depth isn't worth doing. The article discusses how known gadgets were removed in the past.

You only need one dev with the bright idea to pass data around via a clientside blob or cookie.