So let me straight, being the first one a setting it wasn't a vulnerability, instead this one is. I can't see the logic behind their reasoning, in my opinion they are both superficial security policies (ie. badly set defaults)