Honestly, I can't really imagine how this would work at all?

I could see how, given enough data, you'd be able to infer the intended logic of the server and reimplement something that's compatible (I've done this myself with Wireshark + USB devices in the past).

But how would could you reason about specific vulnerabilities in remote code just from a set of requests and responses?