A vulnerability is a way a product or service behaves that breaks a security policy, whether that policy is written down or only implied (3.1); how much risk it carries depends on how likely exploitation is and how much harm it would do in each user's setting. The clause places disclosure inside risk management, which is why advisories state impact and severity (7.4.10, 7.4.11) in a form users can feed into their own risk decisions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.