my interpretation of this is that the existence/disclosure of a vulnerability is entirely distinct from a data breach event (the SEC is mainly concerned with the latter)