If a system is designed to not allow that access, and you can compromise that design, it is most definitely a vulnerability.
So, if you make things harder and someone comes along that invests more effort to overcome, can you really call that a vulnerability? It'd be a real vulnerability if with this access to a user terminal they could elevate permissions on the satellites, but that hasn't been shown (yet?).
To put it another way, consider physical locks, which must inherently be able to resist direct physical tampering by an adversary. Under your definition, no flaw in a lock could be considered a vulnerability since any lock can eventually be cracked. The problem is that this doesn't provide us any useful insight, it just makes the word "vulnerability" useless. It's already well-known that any lock can eventually be cracked, but tradeoffs still have to be made in deciding which lock to use for a certain situation.
Yes. Just because executing the attack doesn't seem to get you anything particularly valuable doesn't make it "not a vulnerability."
We're not personally insulting it, we're just describing reality.
Yes? This is defense in depth. Anything that bypasses a defense is still a vulnerability, even if your backup defenses protect you.
Defending physical hardware is indeed a theoretical impossibility as on paper, it will always be possible to make a perfect electrical clone of the original hardware and then modify it to suit. However, reality is different, and mitigations against physical access have become much more effective in recent years (iPhone anti-jailbreaking and the Xbox One come to mind as fairly successful).
So, this is a vulnerability indeed, just not a high severity one. One layer of the defenses are bypassed, but the remaining defenses remain.
https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
For the same reason, security-by-obscurity is also a valid (though not sufficient) tactic for one of those layers (which also surprises people).
Its about delay and demotivation to slow down your attackers.
If it's hard enough that only state actors can potentially do it, then what does it matter in real life that it's theoretically vulnerable?
E.g.
You may want to protect end users against implants and other attacks from physical tampering with their terminals.
You might not want hostile parties to have an easy time reverse engineering terminals so they can more easily search for remote vulnerabilities in the terminals.
You may not want to hand hostile parties a phased array optimized to transmit to Starlink running arbitrary software of their choice, along with keys identifying the terminal, because even though you think the satellites and authentication mechanisms are robust, making it hard to get this information adds defense in depth.