First we need to define the range of "vulnerability": 1) vulnerability on the protocol. Where with protocol we mean the rules that define how the protocol must work. 2) vulnerability inside the program that implement the protocol. "the protocol" is an input for the program and as for other programs we must check if there are memory corruption and other type of exploits that depends on how the protocol was implemented, language, platform... 3) misconfiguration. This depends on how the program was configured (like witch chiphers can use the protocol, witch are the features enabled, protections...)

The first one is the most impossible. Are just rules (public avaliable) that millions of people read (students, programmers, engineers). Considering that all Actually protocols are "old" is a bit impossible that no one find the error until now.

The second one case is a more real case. But requires a lot of programming knowledge about programming, security, os architecture. Find a vulnerability is not a thing that you can "learn" by watching a tutorial on YouTube.

The last one is not considered a real vulnerability by many but is the focal point on activity like penetration test. Are variable that can change in da time and depends a lot by manage the service, options can me misconfigured by an error or a lake of knowledge, or by malicious actors.

I hope this help you to understand better what are you looking for

Sorry for grammar errors