The init system is not vulnerable. The local dns caching daemon that you can optionally install and that shares the name and maybe some code with the init system is vulnerable.

It's like saying "package dnsmasq.deb is vulnerable, so sysv-init.deb is now vulnerable, they share an extension"