yeah, you are right most of the time clickjacking count as out of the scope but if you find it on signup, payment, login option it's may count as valid.