What else do CAs profit from if it isn't security vulnerabilities?

Their whole purpose is to help with the authentication side of security. They didn't force anyone to use buggy code written by a third party and it is not their fault that many of their customers have gone and done so.