To me, this is a very strange take. As a Pixelfed user I absolutely don’t expect to see text posts on there. It’s very clearly a platform for sharing images.

what’s the difference between the issue not being reported and the issue not being fixed because it’s not seen as a priority

Triaging and investigation take time. Plus having a bunch of open security issues even if they’re not critical destroys public confidence in the software