alt Hacker NewsHow is that different from "People with access to your CMS can put terrible lies on your company website"? The vulnerability is still "people who have access to things have access to things" but written maximally sciencey to hide the fact that there's no vulnerability.
You're right, it's not a vulnerability, it's a flaw of the transformer that makes it unsuitable for what it is peddled to do.