Taken to logical extreme, that would make any black PR or reputational attack a security vulnerability.

Infosec is certainly a hefty part of business continuity, but business continuity itself is a much wider topic.