examples: the choice to implement a 40-bit cipher in a product would not constitute a security vulnerability, even though the protection it provides would be inadequate for some purposes.
An implementation error that inadvertently caused a 256-bit cipher to discard half the bits in the key would be a security vulnerability.