Is automatic new Drupal user to existing CiviCRM contact linking a possible security vulnterability?
It is but isn't specific to civicrm - the problem in that scenario is allowing anonymous signup without either administrator approval or email verification. Set at least the setting in drupal user settings that sends an email to the email on file and then the owner would have to click a link to verify it.