It is a vulnerability, since it really should be auto-deleted if it poses any security risk and no real benefit to keep the folder. I'm not, however, inclined to say that it's a 0day on vBulliten itself, more a combination of a developer who wants the user to have the freedom to make decisions, and forum admins that don't read the install guide past when the forums are up and running.