Apps can have vulnerabilities (intentional or not). It's a contrived example, but maybe some weather app has a custom icon feature, which means you can then browse photos by opening it on the lock screen and going to that setting.
Widgets can't have vulnerabilities?
They can, but scope and features increase surface area: their limited functionality intrinsically limits that.
Widgets are just apps with limited scope and surface area. There’s no reason they can’t apply this to the weather app which already has (or should have) a limited scope.