It's a little bit disingenuous to call intentional wont-fix features "vulnerabilities".