Typically yes. This is base hardening. The usual vulnerabilities can be just default configuration options or unwanted firmware/software features.

Similarly no security team is going to say "There are no vulnerabilities in the servers we purchased." It's just not true, they're always there and expected.