"Vulnerable" these days means a lot of things. The question is if you can actually use the vulnerability of a system to gain access or do something meaningful with it.

I'm now looking into one of the Pentest reports. It states that "Header Disclosure" is a low risk vulnerability. If you take it to the extreme then "a lot" of websites are vulnerable. I would question how the survey was carried out and how questions were framed.