Yes. Vulnerabilities exist with respect to a system's expected functionality and must be understood and weighed against other requirements to determine the syst

Yes. Vulnerabilities exist with respect to a system's expected functionality and must be understood and weighed against other requirements to determine the system's security model. Even if you think the expected functionality is stupid or impossible, that doesn't change the fact that the system has a particular expectation that it doesn't meet and a mechanism by which that expectation can be violated, i.e. a vulnerability. To put it another way, consider physical locks, which must inherently be able to resist direct physical tampering by an adversary. Under your definition, no flaw in a lock could be considered a vulnerability since any lock can eventually be cracked. The problem is that this doesn't provide us any useful insight, it just makes the word "vulnerability" useless. It's already well-known that any lock can eventually be cracked, but tradeoffs still have to be made in deciding which lock to use for a certain situation.