What you said improves your known attack surface for sure. But what do you mean vulnerabilities? CVE's? If so that's inadequate.

What I mean is, system and network architecture on it's own often creates vulnerabilities for that risk model. Let's say you have product X,it is well patched and well configured. Except!, anyone can access it from the intranet and internet. Is this a vulnerability? Can a random attacker password spray product X ,gain access and leverage that access for $profit? It's not exactly a CVE but it can be a vulnerability.

I say invest in good security/IT architects.