This is a classical misstatement of threats and vulnerabilities. In the cited example, threats and vulnerabilities are treated as similar and equal concepts. Rather, they are dissimilar and opposite concepts. Threats face vulnerabilities. They are external to the infrastructure.
Vulnerabilities are defects in the infrastructure.
They are internal and part of the infrastructure. It is so easy to confuse the two concepts. It can only be hoped that the President's advisors are more perceptive in other areas and there reflect more accuracy in their words. All security implementation matters are definable and traceable from the security policy to the design through the resolution of the security requirements. It is important to reiterate that even if a vulnerability appears by virtue of a design fault, it does not necessarily follow that a system weakness has been exposed.