There's enough "usual" vulnerabilities that the practice of fixing them has a name: hardening. For supermicro motherboards specifically, "open services with really shitty default credentials" is apparently one of them — definitely one that is common in a lot of other contexts.

In this context, "unusual" vulnerabilities would be evidence of a deliberate attack, rather than just common security mistakes.