Everything from leaving JTAG interfaces active (which many devices do) to enabling you to reflash a phone without authentication (which the iPhone does) could b

Everything from leaving JTAG interfaces active (which many devices do) to enabling you to reflash a phone without authentication (which the iPhone does) could be considered vulnerabilities. We deal with these because they make more sense than the alternative.