Seth's suggestion (- "arbitrary")

Co-authored-by: Seth Larson <seth@python.org>

Author: StanFromIreland

security/policy.rst

@@ -44,10 +44,9 @@ dead-locks, and resource exhaustion) must be
 triggerable with data inputs that are reasonably sized for the use case.
 Availability vulnerabilities must also demonstrate an "upward" change in posture
 for the attacker, rather than a "lateral" one.
-Unexpected Python exceptions are not vulnerabilities by themselves unless they
-satisfy the availability criteria above.
-This is to avoid handling performance and correctness improvements as security
-vulnerabilities.
+This is to avoid handling performance improvements as security vulnerabilities.
+Exceptions are an expected part of control flow when processing inputs,
+therefore crashes resulting from unhandled exceptions are not security vulnerabilities.
 
 Vulnerabilities in dependencies of Python (such as zlib, Tcl/Tk, or OpenSSL)
 are not vulnerabilities in Python unless Python's use of the dependency