80% of the tickets were exactly like you said: “If the attacker could get X, then they can also do Y” where “getting X” was often equivalent to getting root on the system. Getting root was left as an exercise to the reader.
https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
(actually a hitchhiker's guide to the galaxy quote, but I digress)
What about an LG TV, which is where I mostly watch YouTube? Think the platform is WebOS unless I'm mistaken.