Most of the out-of-band management systems (aka IPMI/DRAC/LOM) that server vendors use are built by the same 2-3 companies and rebranded.

These companies churn out some truly horrible software with little consideration for security.

It's often difficult to automate firmware updates, so they tend to stay vulnerable.

It's a similar situation to webcams: https://youtu.be/B8DjTcANBx0

Typically yes. This is base hardening. The usual vulnerabilities can be just default configuration options or unwanted firmware/software features.

Similarly no security team is going to say "There are no vulnerabilities in the servers we purchased." It's just not true, they're always there and expected.

There's enough "usual" vulnerabilities that the practice of fixing them has a name: hardening. For supermicro motherboards specifically, "open services with really shitty default credentials" is apparently one of them — definitely one that is common in a lot of other contexts.

In this context, "unusual" vulnerabilities would be evidence of a deliberate attack, rather than just common security mistakes.

or they uncovered it using non-standard procedures?