I would argue that the difference is that a defect is something that an ordinary user can encounter when using the product themselves. Triggering security bugs

I would argue that the difference is that a defect is something that an ordinary user can encounter when using the product themselves. Triggering security bugs or zero days are typically things that require highly unusual and targeted usage which are extremely unlikely to occur otherwise. So I would draw a distinction between failure of a product in normal usage and failure of a product when an active adversary is trying to cause it.