In nodejs/node#15564 (comment) @hashseed proposed that a threat model would be defined as framework for evaluating the severity of future vulnerabilities.

What are your opinions on that topic?