Are passwordless logins like ##MS_SQLResourceSigningCertificate## , ##MS_AgentSigningCertificate## a vulnerability?
These logins are created from a certificate.  In fact, if you run the following query:

select 
    name,
    type_desc
from sys.server_principals
where type = 'c';


You will see that they are of type CERTIFICATE_MAPPED_LOGIN.  They are used typically to sign code.  And you cannot use a certificate mapped login to connect with SQL Server.  Please see this BOL reference on CREATE LOGIN:


  Logins created from certificates or asymmetric keys are used only for code signing. They cannot be used to connect to SQL Server.