A vulnerability is not as damning if it wasn't intentionally inserted to be a backdoor. It being easily discoverable suggests that there was no intention to hide it, and thus it was not intended to be a backdoor.

If conversely the vulnerability was difficult to find externally, was publically unknown, and was seen being used for attacks, that would be suggestive of a deliberate backdoor, and far more damning.

If its not hidden, its not a threat to national security kind of "backdoor". A hidden backdoor will only respond to a secret token, you cant just knock on it and get asked "whats the hardcoded password?"