I didn’t see it that way.
It is much like saying the earth can be hit by an asteroid, but we don’t see one right now that is a threat to hit it, or to say that achieving a controlled nuclear fusion reaction is possible, but there isn’t one working yet.
Or, your home is vulnerable to being broken into, but nobody has done so yet, and our street sources don’t indicate a working plan yet.
There is a lot of nefarious stuff, this one seemed pretty standard to me.
Well, then, those being paid handsomely for corporate communications for the richest tech companies in the world could have been more precise by using the world ‘vulnerable’ to indicate the potential for attack. Of course, since their first instinct is to protect their reputations, they are loose with the facts.
‘Affected’ means, well, affected. As in it’s happened already. If it hasn’t then they should say so.