> a 9+ is usually, but not always, more severe than a 2
which is exactly why learning to read these things (the full vector, I believe is what the author meant rather than just the resulting number) is useful when looking at a list of CVEs. Will it tell you the full story and everything you need to know? Of course not. Will it tell you what the impact for your business situation will be? Nope. Does it help you initially filter out the network-accessible no-privileges-required vulnerabilities that apply to your situation because you aren't local on the host and don't have credentials? Yes, that's where it's helpful.
My employer chose to use CVSS vectors to avoid discussions about whether something should be e.g. low/medium/high impact, and frankly I disagree with them. We still have discussions while it limits our ability to represent the likelihood of exploitation, the impact, or the resulting risk. So I'm fully on board that CVSS is very often not representative, especially the final score but sometimes also it just doesn't ask the right 'questions' (the parameters) to reflect what the problem or impact is. But I can still see what the author meant about reading a CVSS vector specified for a CVE.