You're technically correct, but the difference is immaterial unless we're talking about outright pre-auth exploits. Or exploits of the auth itself, I guess.

(I think I recall exactly one in the history of PostgreSQL since I started using it, but it is what it is.)