If I can cause a server to not serve requests to anyone else in the world by sending a well crafted set of bytes, that’s absolutely a vulnerability because it can completely disable critical systems.

If availability isn’t part of CIA then a literal brick fulfills the requirements of security and the entire practice of secure systems is pointless.