In a chained attack, a single vulnerability often yields only limited privileges, and the attacker needs to string together privilege escalation, information leakage, persistence and other steps; RCP's design of scoring each component independently is inherently unable to express cross-component dependencies — even if every component is individually assessed as low-risk, chained together they may still constitute a complete attack chain.