How many actual users suspect that something is wrong with the input, even without URL obfuscation? OTOH, with a permanent XSS it is pretty much game over, even though I doubt that's the case. XSS can do a lot of damage if used properly.

If you can inject JS then you can steal session cookies. Other stuff too, but XSS is a big deal.