The only good defense is a defense in depth. At the moment, their authentication scheme may seem secure. But some day a vulnerability in it will be found, either by an attacker, or by you, or by a disgruntled insider that is already authenticated.
If they were executing proper defense-in-depth, then when that hostile agent gained access to the system, the damage they could do would be limited by further security mechanisms. However, with their attitude that a vulnerability only counts if it can be executed by an outside threat, they are completely throwing away any opportunity to create additional lines of defense.
So, for example, an attacker that was only able to gain limited user access could obtain admin credentials. Their authorization scheme is vulnerable. Or an underpaid employee could decide to run a JS-based cryptocurrency miner on the clients of all of your users to gain a little extra cash on the side. Or a user from outside of finance/management could access internal information for a little insider trading.
Saying XSS doesn't matter because you have to be logged in is functionally equivalent to saying that all logged in users should have permission to see and do everything that all other logged in users do. No users vs admins, no departmental privacy, no user non-repudiation. All users, functionally indistinguishable. If that's not true for their use-case, then XSS is an exploitable vulnerability they should be concerned about.
Edit: If they're convinced that none of the above could happen, I recommend you switch to social engineering attacks on the authentication scheme. The most secure authentication schemes still require human interaction and so are depressingly vulnerable.