TL;DR Reflected input is often unexploitable because the attack ends up in a place which stops it activating, such as within a comment section, or inside an attribute.