In web3 security, anything that can be leveraged by a hacker to exploit the protocol should be considered a vulnerability. It could be anything, for example how a blockchain or the entire project is structured, bugs in the underlying code, or an error of bad practice due to privileged access