first of all the lead is not cited because all the information is cited in the body. See WP:CITELEAD.
Second, I don't think image copyright issues should affect the implementation of the rest of the edit while we are waiting for an answer on the copyright board
I believe that bugs in non-used code are not usually called vulnerabilities because the security risk is not the same. The definition of zero day vulnerability in this article is consistent with that offered in the cited sources :
"A zero-day vulnerability is one for which no patch has been developed" Defender's Dilemma p. xvi
"a vulnerability in the software that has never been made public and for which there is no known fix." (O'Harrow)
" a zero-day is a software or hardware flaw for which there is no existing patch "
