Compensating controls can change exploitability

A flaw sitting behind something that blocks the route to it is genuinely less exploitable, and the score does not know that.

This is legitimate and it is also the most common place prioritisation gets fudged, because "we have a compensating control" is easy to assert and hard to check. The honest version names the control, explains why it blocks this specific path, and is tested. The dishonest version is a sentence in a spreadsheet.