But Apache isn't misconfigured in this instance - a file was uploaded and people are claiming that being able to view that file is a vulnerability.

I guess it is a vulnerability of the same standard as "My password is: password".

I just don't understand why everyone is up-in-arms and so surprised by this "vulnerability." It's common sense...