I don't think it's realistic to expect airline support staff to know how to properly classify and route web vulnerabilities. Giving someone points is just a way to get them to go away so the ticket can be closed.
Most companies don't give them the training, autonomy, problem solving tools, or even buy-in to deal with something like this.
When I call in I expect them to be able to change my reservation and handle seat changes and such. I don't expect them to be able to triage a tech support call and tell the difference in severity between, say, a shared computer with somebody else's login, a browser caching issue, a database hack, a proxy or CDN issue, etc.
For that to actually happen support staff has to be empowered to think for themselves and also be compensated enough to care.