Does it still count as a vulnerability if it is by design?

You mean, a messaging app offered by Meta isn’t secure? I’m shocked, I say, shocked!

Anyway…