Add language clarifying scope around product vulnerabilities

[nightwatchcyber]

See:
https://twitter.com/FrancoisMarot/status/1221799947198193664
https://twitter.com/nightwatchcyber/status/1222622119177150466

Reported by @fmarot

[nightwatchcyber]

Addressing in version -10 draft

[EdOverflow]

Can we close #184 in favour of this?

[nightwatchcyber]

I think these are two distinct issues - #184 is about how to embed the file while this issue is about the scope of the file when it's found

[nightwatchcyber]

As per #201, file systems and similar embedding schemes have been deferred to the future