I would say that PasswordAuthentication=yes is by itself a vulnerability.