The parent didn't say "vulnerability" in the "security vulnerability" sense. They sad "vulnerable to a flaw", i.e. there is a design flaw and those versions have that design flaw - meaning users of it are vulnerable to apps taking advantage of that design flaw. I'd say it leaves users "vulnerable", and it's definitely a "flaw". It may be an API working as intended - but that doesn't mean it isn't flawed to the point of being embarrassing.