It can be a judgment call as to how likely a problem might be a one-off issue. Factors like the number of users in the test who had the same problem, the level of severity, and the confidence of the facilitator that the scenario was realistic and uncompromised all contribute to the severity rating of the issue.