i mean it makes sense to me, a vulnerability is a vulnerability regardless of whether it has been exploited or not